share the forge and schedule wire types through swarm-controller-api

swarmctl hand-mirrored the controller's forge make-admin response and
the /api/schedules bodies. Both now import them from a new serde-only
crate, swarm-controller-api, the way hivectl and hive-c0re share
hive-host-sock. ToSchema sits behind its schema feature, which only
the controller turns on.

The wire format is unchanged: round-trip tests in the new crate pin
each type against the JSON the controller and swarmctl produced, and
the controller's OpenAPI document for these routes is byte-identical.

Files: swarm-controller-api/ is the new crate; swarm-controller and
swarmctl (src, Cargo.toml, Cargo.lock, root Cargo.toml) switch to it;
CLAUDE.md lists the crate and which swarmctl shapes are still local
mirrors; swarmctl/README.md says the forge and schedule bodies come
from the crate, so none of its lines still call them mirrored.

Part of #5472.

Cargo.lock

@@ -4884,6 +4884,7 @@ dependencies = [
  "similar",
  "strum",
  "swarm-authelia-bridge-sock",
+ "swarm-controller-api",
  "swarm-matrix-client",
  "swarm-queue-client",
  "swarm-secret-client",
@@ -4898,6 +4899,15 @@ dependencies = [
  "x509-cert",
 ]
 
+[[package]]
+name = "swarm-controller-api"
+version = "0.1.0"
+dependencies = [
+ "serde",
+ "serde_json",
+ "utoipa",
+]
+
 [[package]]
 name = "swarm-logs"
 version = "0.1.0"
@@ -5085,6 +5095,7 @@ dependencies = [
  "serde_json",
  "serde_norway",
  "sha2 0.11.0",
+ "swarm-controller-api",
  "tokio",
  "url",
 ]