swarm: show subagent terminals in the swarm UI

An agent's subagent daemon publishes each subagent's output as terminal
rows on `$SWARM.term.<agent>.sub.<subagent>`, as the agent, into a
per-agent stream it creates itself; swarm-controller lists an agent's
subagents from that stream's subjects and relays one subagent's rows as
SSE; the swarm UI lists them under the agent's terminal preview and
reuses AgentTermPreview, full-screen tab included, with no input.

- swarm-nats.nix: the agent token may also publish
  `$SWARM.term.{agent}.sub.>` and `$JS.API.STREAM.CREATE|INFO` on
  `term-sub-{agent}`, and nothing else of JetStream. A module-eval arm
  pins the agent-token grant as an exact list.
- mcp.nix: hive-subagent-daemon loads the agent's store identity
  (`hive-agent-bao-cert/-key/-server-ca`, the ones hive-agent loads)
  whenever the agent has a store, not only on the opencode preset. The
  agent's own queue secret lives in the store, so this is the credential
  the harness connects with.
- hive-subagent-mcp: `swarm_term` reads the agent's queue secret under
  that identity, connects with the agent token, opens or creates
  `term-sub-<agent>` (max_age 24h), and publishes classified rows from
  the sink every subagent line already passes through. The sink only
  queues (bounded, drop-and-count); a missing store, refused credential,
  failed stream create or failed publish is a log line.
- The stream-json classifier (`stream_enrich`) and the `TermMsg` row
  types plus `fit` move from the hive-agent binary into hive-sh4re, so
  the subagent daemon publishes the rows AgentTermPreview already
  renders. hive-agent keeps its LiveEvent classifier on top.
- swarm-controller: `GET /api/agents/{name}/subagents` and
  `GET /api/agents/{name}/subagents/{subagent}/term/stream`.
- docs/swarm: what the UI shows and what the queue carries.

Closes #4827

docs/swarm/ui.md

@@ -7,18 +7,45 @@ domain, covers host-level detail for one hive.
 
 ## What it shows
 
-| route                     | what                                                                                                |
-| ------------------------- | --------------------------------------------------------------------------------------------------- |
-| `/`                       | the hive directory, each hive with its last reported status                                         |
-| `/agents`                 | every agent: status, config PR, wanted state; create agents, link forge, matrix and GitHub accounts |
-| `/agents/<name>/terminal` | one agent's live terminal                                                                           |
-| `/jobs`                   | the controller's job graph — where agent creation and credential mints show progress                |
-| `/issues`                 | a cross-repo issue report                                                                           |
+| route                                          | what                                                                                                |
+| ---------------------------------------------- | --------------------------------------------------------------------------------------------------- |
+| `/`                                            | the hive directory, each hive with its last reported status                                         |
+| `/agents`                                      | every agent: status, config PR, wanted state; create agents, link forge, matrix and GitHub accounts |
+| `/agents/<name>/terminal`                      | one agent's live terminal                                                                           |
+| `/agents/<name>/subagents/<subagent>/terminal` | one of that agent's subagents' live terminal                                                        |
+| `/jobs`                                        | the controller's job graph — where agent creation and credential mints show progress                |
+| `/issues`                                      | a cross-repo issue report                                                                           |
 
 Everything it shows comes from [`swarm-controller`](../../swarm-controller/README.md).
 An agent created here or with `swarmctl agent create` starts `paused`; set it
 `up` from its card.
 
+### Agent and subagent terminals
+
+An agent's detail panel on `/agents` shows a small live preview of its
+terminal, and below it the agent's **subagents**: every subagent the swarm
+queue holds terminal rows for from the last 24 hours. Picking one shows its
+terminal in the same preview, and **expand** opens it in its own tab, as it
+does for the agent. The list refreshes every 10 seconds, so a subagent the
+agent spawns shows up once it writes output.
+
+Both terminals are live views with no input box: a preview shows rows
+published while it's open. Subagents take no input from the swarm. A subagent
+terminal has no turn-state badges.
+
+<details><summary>Where the subagent list and rows come from</summary>
+
+The agent's subagent daemon publishes each subagent's terminal rows on
+`$SWARM.term.<agent>.sub.<subagent>` with the agent's own queue credential,
+into a stream named `term-sub-<agent>` that it creates on first use. The
+stream keeps rows for 24 hours. swarm-controller serves the list as
+`GET /api/agents/<name>/subagents`, the subagents named by the subjects in that
+stream, and relays one subagent's rows as SSE on
+`GET /api/agents/<name>/subagents/<subagent>/term/stream`. An agent with no
+store identity, or no queue address, publishes no subagent terminals.
+
+</details>
+
 ### Linking external accounts
 
 Each agent on `/agents` opens three dialogs that write a credential for it