swarm: show subagent terminals in the swarm UI

An agent's subagent daemon publishes each subagent's output as terminal
rows on `$SWARM.term.<agent>.sub.<subagent>`, as the agent, into a
per-agent stream it creates itself; swarm-controller lists an agent's
subagents from that stream's subjects and relays one subagent's rows as
SSE; the swarm UI lists them under the agent's terminal preview and
reuses AgentTermPreview, full-screen tab included, with no input.

- swarm-nats.nix: the agent token may also publish
  `$SWARM.term.{agent}.sub.>` and `$JS.API.STREAM.CREATE|INFO` on
  `term-sub-{agent}`, and nothing else of JetStream. A module-eval arm
  pins the agent-token grant as an exact list.
- mcp.nix: hive-subagent-daemon loads the agent's store identity
  (`hive-agent-bao-cert/-key/-server-ca`, the ones hive-agent loads)
  whenever the agent has a store, not only on the opencode preset. The
  agent's own queue secret lives in the store, so this is the credential
  the harness connects with.
- hive-subagent-mcp: `swarm_term` reads the agent's queue secret under
  that identity, connects with the agent token, opens or creates
  `term-sub-<agent>` (max_age 24h), and publishes classified rows from
  the sink every subagent line already passes through. The sink only
  queues (bounded, drop-and-count); a missing store, refused credential,
  failed stream create or failed publish is a log line.
- The stream-json classifier (`stream_enrich`) and the `TermMsg` row
  types plus `fit` move from the hive-agent binary into hive-sh4re, so
  the subagent daemon publishes the rows AgentTermPreview already
  renders. hive-agent keeps its LiveEvent classifier on top.
- swarm-controller: `GET /api/agents/{name}/subagents` and
  `GET /api/agents/{name}/subagents/{subagent}/term/stream`.
- docs/swarm: what the UI shows and what the queue carries.

Closes #4827

frontend/packages/swarm-ui/src/pages/agents/AgentTerminalPage.tsx

@@ -13,30 +13,42 @@
 // idempotent (dedupes by href), so this is safe to call every mount.
 import { useEffect } from "preact/hooks";
 import type { RouteComponentProps } from "wouter-preact";
-import { AgentTermPreview } from "./AgentTermPreview.js";
+import { AgentTermPreview, termPaths } from "./AgentTermPreview.js";
 import { useDynamicTabs } from "../../shell/useDynamicTabs.js";
 import "./AgentTerminalPage.css";
 
+// Also mounted at `/agents/:name/subagents/:subagent/terminal`, for one of
+// the agent's subagents.
 export function AgentTerminalPage({
   params,
-}: RouteComponentProps<{ name: string }>) {
+}: RouteComponentProps<{ name: string; subagent?: string }>) {
   const { open } = useDynamicTabs();
   const name = decodeURIComponent(params.name);
+  const subagent =
+    params.subagent === undefined
+      ? undefined
+      : decodeURIComponent(params.subagent);
+  const { page, label } = termPaths(name, subagent);
 
-  // Runs once per mounted agent name — re-registering on every render
+  // Runs once per mounted terminal — re-registering on every render
   // would just be redundant work against an already-deduped list, but
   // there's no reason to pay it more than once per identity.
   useEffect(() => {
-    open({ href: `/agents/${encodeURIComponent(name)}/terminal`, label: name });
+    open({ href: page, label });
     // eslint-disable-next-line react-hooks/exhaustive-deps -- `open` is a
     // fresh function identity every render (`useDynamicTabs` doesn't
     // memoize it); including it would re-fire this effect every render
-    // instead of once per agent `name`.
-  }, [name]);
+    // instead of once per terminal `page`.
+  }, [page]);
 
   return (
     <div class="ui-agent-terminal-page">
-      <AgentTermPreview agentName={name} fullHeight showHeaderBadges />
+      <AgentTermPreview
+        agentName={name}
+        subagent={subagent}
+        fullHeight
+        showHeaderBadges
+      />
     </div>
   );
 }