swarm UI: log an agent into claude from its card; the credentials go to bao and the agent picks them up

A new swarm service, `swarm-claude-login`, in its own container on the host
that sets `deploy.claude-login.enable` (defaulted on by `allSwarmServices`
where the host has the minter's store leaf, like the review classifier).

- swarm-ui: an agent card showing "login needed" gets a "log in" button.
  Its dialog starts the login, shows the URL claude printed, and takes the
  pasted code.
- swarm-controller: `POST/DELETE /api/agents/{name}/claude-login` and
  `POST /api/agents/{name}/claude-login/code`, behind the swarm UI's
  authelia-gated `/api/`, relay the steps to the minter as requests on
  `$SWARM.claude-login.request`.
- swarm-claude-login: runs `claude auth login` over piped stdio with HOME
  and CLAUDE_CONFIG_DIR in a per-login scratch dir, scrapes the first
  https URL, writes the code to stdin, and stores the `.credentials.json`
  at `swarm/agents/<agent>/claude-credentials` with a KV v2 write, a new
  version over any earlier one. The scratch dir goes on every exit path; a
  login waits 15 minutes for its code.
- hive-agent: while parked in `wait_for_login`, reads that leaf every 30 s
  under the agent's own cert and installs it only when its KV version is
  newer than the one recorded in `<harness>/claude-credentials-version`.
  An equal or older version is never put back, because claude rotates the
  refresh token and the stored copy is stale after the first refresh.
- swarm-secret-client: `claude_login` paths and `SecretStore::read_versioned`.
- Credentials: a `claude-login` store leaf minted by glue-bao-tls, a
  `swarm-claude-login` policy (create/update on
  `swarm/agents/+/claude-credentials`, read on its own queue client
  secret), an authelia machine client, and a `--claude-login-client`
  grant in the queue's auth-callout responder. The unit runs as a static
  system user.

The hive's own web-UI login is unchanged.

Refs #5268

frontend/packages/swarm-ui/src/agent/claude-login/ClaudeLoginDialog.tsx

@@ -0,0 +1,130 @@
+// <ClaudeLoginDialog> — logs one agent in to claude through the swarm's
+// login minter. Opening it starts the login (`POST …/claude-login`), which
+// answers with the URL claude printed; the operator opens it and pastes the
+// code back (`POST …/claude-login/code`). Closing it while the code is
+// still awaited stops the login (`DELETE …/claude-login`).
+//
+// Mounted only while open, so each open is a fresh login.
+import { useEffect, useState } from "preact/hooks";
+import { ApiErrorPanel } from "@hive/shared/api-error-panel.js";
+import { readApiError, type ProblemDetails } from "@hive/shared/api-error.js";
+import { Button } from "../../ui/button/Button.js";
+import { Dialog } from "../../ui/dialog/Dialog.js";
+import { Panel } from "../../ui/panel/Panel.js";
+import { TextField } from "../../ui/text-field/TextField.js";
+import {
+  afterCode,
+  afterStart,
+  claudeLoginPath,
+  leavesLoginRunning,
+  pastedCode,
+  type LoginStep,
+} from "./ClaudeLoginSteps.js";
+import "./ClaudeLoginDialog.css";
+
+async function problemOf(r: Response): Promise<ProblemDetails | null> {
+  return r.ok ? null : await readApiError(r);
+}
+
+export function ClaudeLoginDialog({
+  agent,
+  onClose,
+}: {
+  agent: string;
+  onClose: () => void;
+}) {
+  const [step, setStep] = useState<LoginStep>({ step: "starting" });
+  const [code, setCode] = useState("");
+
+  useEffect(() => {
+    let live = true;
+    void (async () => {
+      try {
+        const r = await fetch(claudeLoginPath(agent), { method: "POST" });
+        const problem = await problemOf(r);
+        const next = afterStart(
+          problem ? { problem } : ((await r.json()) as { url: string }),
+        );
+        if (live) setStep(next);
+      } catch (err) {
+        if (live) setStep(afterStart({ problem: { detail: String(err) } }));
+      }
+    })();
+    return () => {
+      live = false;
+    };
+  }, [agent]);
+
+  function close() {
+    if (leavesLoginRunning(step)) {
+      void fetch(claudeLoginPath(agent), { method: "DELETE" });
+    }
+    onClose();
+  }
+
+  async function submit(e: Event) {
+    e.preventDefault();
+    const pasted = pastedCode(code);
+    if (step.step !== "code" || pasted === null) return;
+    const { url } = step;
+    setStep({ step: "submitting", url });
+    try {
+      const r = await fetch(claudeLoginPath(agent, true), {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ code: pasted }),
+      });
+      setStep(afterCode(await problemOf(r)));
+    } catch (err) {
+      setStep(afterCode({ detail: String(err) }));
+    }
+    setCode("");
+  }
+
+  return (
+    <Dialog open onClose={close} label={`log ${agent} in to claude`} plain>
+      <Panel title={`log in to claude — ${agent}`} icon="🔑" onClose={close}>
+        {step.step === "starting" && <p>starting the login…</p>}
+        {(step.step === "code" || step.step === "submitting") && (
+          <>
+            <p>
+              Open{" "}
+              <a href={step.url} target="_blank" rel="noopener noreferrer">
+                the claude login page
+              </a>
+              , sign in with this agent's account, and paste the code it shows.
+            </p>
+            <form class="claude-login-form" onSubmit={submit}>
+              <TextField
+                id="claude-login-code"
+                label="code"
+                value={code}
+                required
+                onInput={setCode}
+              />
+              <Button
+                variant="primary"
+                type="submit"
+                disabled={step.step === "submitting"}
+              >
+                {step.step === "submitting" ? "logging in…" : "log in"}
+              </Button>
+            </form>
+          </>
+        )}
+        {step.step === "stored" && (
+          <p class="claude-login-ok">
+            Stored. <strong>{agent}</strong> picks the login up within a minute
+            and resumes.
+          </p>
+        )}
+        {step.step === "failed" && (
+          <ApiErrorPanel
+            context="the claude login failed; close and start again"
+            problem={step.problem}
+          />
+        )}
+      </Panel>
+    </Dialog>
+  );
+}