share the forge and schedule wire types through swarm-controller-api

swarmctl hand-mirrored the controller's forge make-admin response and
the /api/schedules bodies. Both now import them from a new serde-only
crate, swarm-controller-api, the way hivectl and hive-c0re share
hive-host-sock. ToSchema sits behind its schema feature, which only
the controller turns on.

The wire format is unchanged: round-trip tests in the new crate pin
each type against the JSON the controller and swarmctl produced, and
the controller's OpenAPI document for these routes is byte-identical.

Files: swarm-controller-api/ is the new crate; swarm-controller and
swarmctl (src, Cargo.toml, Cargo.lock, root Cargo.toml) switch to it;
CLAUDE.md lists the crate and which swarmctl shapes are still local
mirrors; swarmctl/README.md says the forge and schedule bodies come
from the crate, so none of its lines still call them mirrored.

Part of #5472.

swarm-controller-api/README.md

@@ -0,0 +1,21 @@
+# swarm-controller-api
+
+Wire types for **swarm-controller's HTTP API**, the request and response
+bodies both `swarm-controller` (server) and `swarmctl` (client) import.
+Serde only: no server or client logic, no tokio, no axum.
+
+## Why it's its own crate
+
+`swarmctl` doesn't link `swarm-controller`, for the same reason `hivectl`
+doesn't link `hive-c0re`. The two still share one contract, the same way
+`hivectl` and `hive-c0re` share `hive-host-sock`: a field renamed on one side
+is a compile error on the other, not a 400 the operator finds at runtime.
+
+The `schema` feature derives utoipa's `ToSchema` on every type, for the
+controller's `OpenAPI` spec. `swarmctl` leaves it off.
+
+## What's here
+
+One module per endpoint family: `forge` (`POST /api/forge/users/{name}/admin`)
+and `schedules` (`/api/schedules`). The agent-create, inference and
+permissions bodies are still mirrored by hand in `swarmctl`.