swarm: show subagent terminals in the swarm UI

An agent's subagent daemon publishes each subagent's output as terminal
rows on `$SWARM.term.<agent>.sub.<subagent>`, as the agent, into a
per-agent stream it creates itself; swarm-controller lists an agent's
subagents from that stream's subjects and relays one subagent's rows as
SSE; the swarm UI lists them under the agent's terminal preview and
reuses AgentTermPreview, full-screen tab included, with no input.

- swarm-nats.nix: the agent token may also publish
  `$SWARM.term.{agent}.sub.>` and `$JS.API.STREAM.CREATE|INFO` on
  `term-sub-{agent}`, and nothing else of JetStream. A module-eval arm
  pins the agent-token grant as an exact list.
- mcp.nix: hive-subagent-daemon loads the agent's store identity
  (`hive-agent-bao-cert/-key/-server-ca`, the ones hive-agent loads)
  whenever the agent has a store, not only on the opencode preset. The
  agent's own queue secret lives in the store, so this is the credential
  the harness connects with.
- hive-subagent-mcp: `swarm_term` reads the agent's queue secret under
  that identity, connects with the agent token, opens or creates
  `term-sub-<agent>` (max_age 24h), and publishes classified rows from
  the sink every subagent line already passes through. The sink only
  queues (bounded, drop-and-count); a missing store, refused credential,
  failed stream create or failed publish is a log line.
- The stream-json classifier (`stream_enrich`) and the `TermMsg` row
  types plus `fit` move from the hive-agent binary into hive-sh4re, so
  the subagent daemon publishes the rows AgentTermPreview already
  renders. hive-agent keeps its LiveEvent classifier on top.
- swarm-controller: `GET /api/agents/{name}/subagents` and
  `GET /api/agents/{name}/subagents/{subagent}/term/stream`.
- docs/swarm: what the UI shows and what the queue carries.

Closes #4827

frontend/packages/swarm-ui/src/pages/agents/AgentTermPreview.tsx

@@ -2,9 +2,10 @@
 // page, a small read-only preview embedded below `AgentsPage`'s detail
 // panel fields. No input — sending input back to the agent is explicitly
 // follow-up scope, not this issue's. Consumes swarm-controller's
-// `GET /api/agents/{name}/term/stream` via `useSwarmTermStream`,
-// rendering through the same `@hive/shared` `Row` component the per-hive
-// local terminal uses — "share components between hive and swarm level
+// `GET /api/agents/{name}/term/stream`, or for a subagent
+// `GET /api/agents/{name}/subagents/{subagent}/term/stream`, via
+// `useSwarmTermStream`, rendering through the same `@hive/shared` `Row`
+// component the per-hive local terminal uses — "share components between hive and swarm level
 // term as much as possible" (mara).
 //
 // **Floating header badges** — turn state / model / ctx / cost parity
@@ -100,21 +101,50 @@ function fmtTokens(n: number): string {
   return String(n);
 }
 
+// The paths one terminal is reached at. A subagent's terminal sits under its
+// agent's, and has no turn-state header: the swarm relays none for it.
+interface TermPaths {
+  label: string;
+  page: string;
+  stream: string;
+  state: string | null;
+}
+
+export function termPaths(agentName: string, subagent?: string): TermPaths {
+  const agent = `/agents/${encodeURIComponent(agentName)}`;
+  if (subagent === undefined) {
+    return {
+      label: agentName,
+      page: `${agent}/terminal`,
+      stream: `/api${agent}/term/stream`,
+      state: `/api${agent}/state/stream`,
+    };
+  }
+  const sub = `${agent}/subagents/${encodeURIComponent(subagent)}`;
+  return {
+    label: `${agentName}/${subagent}`,
+    page: `${sub}/terminal`,
+    stream: `/api${sub}/term/stream`,
+    state: null,
+  };
+}
+
 export function AgentTermPreview({
   agentName,
+  subagent,
   showHeaderBadges = true,
   fullHeight = false,
 }: {
   agentName: string;
+  // Set: this is one of `agentName`'s subagents, output only like the
+  // agent's own.
+  subagent?: string;
   showHeaderBadges?: boolean;
   fullHeight?: boolean;
 }) {
-  const { rows, connection } = useSwarmTermStream(
-    `/api/agents/${encodeURIComponent(agentName)}/term/stream`,
-  );
-  const { header } = useSwarmAgentStateStream(
-    `/api/agents/${encodeURIComponent(agentName)}/state/stream`,
-  );
+  const paths = termPaths(agentName, subagent);
+  const { rows, connection } = useSwarmTermStream(paths.stream);
+  const { header } = useSwarmAgentStateStream(paths.state);
   const { open: openTab } = useDynamicTabs();
   const logRef = useRef<HTMLDivElement>(null);
   const [stickToBottom, setStickToBottom] = useState(true);
@@ -156,13 +186,8 @@ export function AgentTermPreview({
             variant="quiet"
             icon={<ExpandIcon />}
             value="expand"
-            title={`open ${agentName}'s terminal in its own tab`}
-            onClick={() =>
-              openTab({
-                href: `/agents/${encodeURIComponent(agentName)}/terminal`,
-                label: agentName,
-              })
-            }
+            title={`open ${paths.label}'s terminal in its own tab`}
+            onClick={() => openTab({ href: paths.page, label: paths.label })}
           />
         )}
       </div>