swarm: show subagent terminals in the swarm UI

An agent's subagent daemon publishes each subagent's output as terminal
rows on `$SWARM.term.<agent>.sub.<subagent>`, as the agent, into a
per-agent stream it creates itself; swarm-controller lists an agent's
subagents from that stream's subjects and relays one subagent's rows as
SSE; the swarm UI lists them under the agent's terminal preview and
reuses AgentTermPreview, full-screen tab included, with no input.

- swarm-nats.nix: the agent token may also publish
  `$SWARM.term.{agent}.sub.>` and `$JS.API.STREAM.CREATE|INFO` on
  `term-sub-{agent}`, and nothing else of JetStream. A module-eval arm
  pins the agent-token grant as an exact list.
- mcp.nix: hive-subagent-daemon loads the agent's store identity
  (`hive-agent-bao-cert/-key/-server-ca`, the ones hive-agent loads)
  whenever the agent has a store, not only on the opencode preset. The
  agent's own queue secret lives in the store, so this is the credential
  the harness connects with.
- hive-subagent-mcp: `swarm_term` reads the agent's queue secret under
  that identity, connects with the agent token, opens or creates
  `term-sub-<agent>` (max_age 24h), and publishes classified rows from
  the sink every subagent line already passes through. The sink only
  queues (bounded, drop-and-count); a missing store, refused credential,
  failed stream create or failed publish is a log line.
- The stream-json classifier (`stream_enrich`) and the `TermMsg` row
  types plus `fit` move from the hive-agent binary into hive-sh4re, so
  the subagent daemon publishes the rows AgentTermPreview already
  renders. hive-agent keeps its LiveEvent classifier on top.
- swarm-controller: `GET /api/agents/{name}/subagents` and
  `GET /api/agents/{name}/subagents/{subagent}/term/stream`.
- docs/swarm: what the UI shows and what the queue carries.

Closes #4827

nix/module-eval/nats-authelia.nix

@@ -161,6 +161,32 @@ let
         in
         lib.hasInfix "--agent-token-publish-subject '$$KV.agent-icons.{agent}'" exec;
     }
+    {
+      # The whole per-agent grant, compared as a list rather than by infix: a
+      # wider subject added beside these (`$$JS.API.>`, another stream's name)
+      # would pass every presence check above.
+      name = "a verified agent's grant is exactly its own subjects and its subagent stream";
+      ok =
+        let
+          args = lib.splitString " " (responderOf natsOldPath).serviceConfig.ExecStart;
+          granted = lib.concatLists (
+            lib.imap0 (
+              i: a:
+              lib.optional (a == "--agent-token-publish-subject" && i + 1 < lib.length args) (
+                lib.elemAt args (i + 1)
+              )
+            ) args
+          );
+        in
+        granted == [
+          "'$$SWARM.term.{agent}'"
+          "'$$SWARM.agent-state.{agent}'"
+          "'$$KV.agent-icons.{agent}'"
+          "'$$SWARM.term.{agent}.sub.>'"
+          "'$$JS.API.STREAM.CREATE.term-sub-{agent}'"
+          "'$$JS.API.STREAM.INFO.term-sub-{agent}'"
+        ];
+    }
     {
       # Each credential by `LoadCredential`, and the environment naming where
       # the unit sees it: a DynamicUser cannot read the copies directly.