swarm-ui, hive dashboard, agent page: one profile menu with the signed-in user, avatar and authelia links

The swarm UI's user menu moves to @hive/shared and takes the whoami URL and
authelia's URL as props; the swarm UI keeps a thin wrapper, and the hive
dashboard and the per-agent page mount the same component. The dashboard's
nginx vhost proxies /api/whoami to authelia (the agent page is served from
the same vhost), and hive-c0re's state carries authelia_public_url, set from
services.hyperhive.swarm.authelia.url. The agent page shows the menu only
behind the gateway.

docs/web-ui/agent.md

@@ -70,6 +70,13 @@ at a given viewport width. Two columns:
     unprivileged process can't make directly).
   - **Inbox / todos pills** (`📬 inbox · N` / `📋 todos · N`): hidden
     when empty; selecting it opens the matching flyout in the side panel.
+  - **Profile avatar**: the signed-in user's initial, opening a popover with
+    their name and links to authelia's settings and sign-out pages, as on the
+    dashboard (`AgentUserMenu.tsx`). It shows only behind the gateway, where
+    the page shares the dashboard's origin and session; opened on the agent's
+    own port there is no sign-in and no avatar. The name comes from the
+    dashboard's `/api/whoami`, authelia's URL from the dashboard's
+    `/api/state`.
   - **Links badge** (`🔗`): opens a popover listing `↑ dashboard`
     (back-link to the host dashboard, `${dashboardBase}`)
     followed by this agent's `agent_links()`-sourced navigation (stats,

docs/web-ui/dashboard.md

@@ -24,6 +24,15 @@ dashboard tab strip.
   comes from `state.swarm_public_url`, which hive-c0re reads from
   `HIVE_SWARM_PUBLIC_URL` (set from `services.hyperhive.swarm.domain`);
   with no domain set there is no swarm entry. The standalone pages link back to `/`.
+- **Profile menu**: the signed-in user's avatar at the right end of the
+  chrome (`user-menu.js`, the same component as the swarm UI's and the agent
+  page's). It opens a popover with the user's name and links to authelia's
+  settings and sign-out pages. The name comes from `/api/whoami`, which the
+  dashboard's nginx vhost proxies to authelia, and the links from
+  `state.authelia_public_url`, which hive-c0re reads from
+  `HIVE_AUTHELIA_PUBLIC_URL` (set from `services.hyperhive.swarm.authelia.url`).
+  If the name doesn't load the avatar shows a question mark, and without the URL the
+  popover has no links.
 - **Tab strip**: `◆ 4G3NTS ◆`, `◆ R3BU1LD QU3U3 ◆`, `◆ M3T4 1NPUTS ◆`,
   `◆ BUILD L0GS ◆`, `◆ K3PT ST4T3 ◆`. In-page tabs only — ST4TS
   lives on its own page, reached from the pages menu. Count pills on