swarm-controller: replay a subagent's newest rows before its live tail

A subagent's terminal opened directly showed nothing until the subagent
published again: the relay was a core subscription, though its rows sit
in term-sub-<agent> for 24 hours. It now goes through the agent route's
replay-then-tail, so it opens with the subagent's newest 100 rows and
resumes after Last-Event-ID.

- term_stream.rs: the replay takes a stream name and a filter subject
  instead of an agent, and `replay_or_live` (replay, else the live core
  subscription) is the one fn both routes call. When the filter is one of
  several subjects in the stream, a fresh reader's consumer starts at the
  oldest row and drops all but the newest REPLAY_ROWS it counts as
  pending, since the stream's newest sequences may belong to sibling
  subagents. A single-subject stream (term-main-<agent>) picks its start
  with replay_start exactly as before. Tests for both subagent cases.
- subagent_term.rs: the relay calls replay_or_live on the subagent's
  subject in term-sub-<agent> and reads Last-Event-ID; module doc and
  OpenAPI text no longer say "live only".
- main.rs: the handler test passes the new headers argument.
- swarm-queue-client agent_term.rs: replay_consumer_config takes the
  filter subject instead of the agent.
- swarm-queue-client subagent_term.rs: consumer_create_grant, the
  extended CONSUMER.CREATE form with a subagent subject as filter.
- swarm-nats-auth policy.rs: the controller holds that grant; the agent
  grant's `$SWARM.term.*` filter is two tokens short of a subagent
  subject, and the test that refused it now admits it.
- docs/swarm/ui.md, README.md: a subagent terminal opens with its newest
  rows.

Fixes #5527

swarm-queue-client/src/subagent_term.rs

@@ -6,17 +6,18 @@
 //! credential. The queue grants that credential publish on this subject
 //! family and no `JetStream` subject.
 //!
-//! The stream exists so the swarm can list an agent's subagents: subagents
+//! The stream lets the swarm list an agent's subagents: subagents
 //! are spawned on demand under caller-chosen names, and the set of subjects
 //! the stream holds is the list. `swarm-controller` creates one stream per
 //! agent with the fixed config [`crate::subagent_term::open_or_create`]
 //! spells, and takes the list from its subject counts
-//! ([`crate::subagent_term::subagent_names`]).
+//! ([`crate::subagent_term::subagent_names`]). A reader attaching to one
+//! subagent's terminal replays that subagent's newest rows from it.
 //!
-//! The name and the subject live here because three crates must agree on
-//! them: the publisher in `hive-subagent-mcp`, `swarm-controller`, and the
-//! queue grant in `swarm-nats.nix`, whose `{agent}` template spells the same
-//! subjects.
+//! The name and the subject live here because they must agree across the
+//! publisher in `hive-subagent-mcp`, `swarm-controller`, the queue grant in
+//! `swarm-nats.nix`, whose `{agent}` template spells the same subjects, and
+//! the reader's consumer grant in `swarm-nats-auth`.
 
 use crate::TERM_SUBJECT_PREFIX;
 
@@ -56,6 +57,17 @@ pub fn subject_wildcard() -> String {
     subject("*", "*")
 }
 
+/// The reader's grant to create a replay consumer on one subagent's rows:
+/// the extended create form of [`crate::agent_term::consumer_create_grant`],
+/// on any stream and under any consumer name, with a [`subject`] as the
+/// filter tokens the server checks the payload against. The last `*` also
+/// matches a literal `*` or `>`, so it admits `$SWARM.term.<agent>.sub.>`
+/// too, and nothing outside [`subject_wildcard`]'s family.
+#[must_use]
+pub fn consumer_create_grant() -> String {
+    format!("$JS.API.CONSUMER.CREATE.*.*.{}", subject_wildcard())
+}
+
 /// Every subject [`stream_name`]'s stream captures, which is also the publish
 /// grant's shape.
 #[must_use]
@@ -149,6 +161,10 @@ mod tests {
         assert_eq!(stream_name("iris"), "term-sub-iris");
         assert_eq!(subject("iris", "scout"), "$SWARM.term.iris.sub.scout");
         assert_eq!(stream_subjects("iris"), "$SWARM.term.iris.sub.>");
+        assert_eq!(
+            consumer_create_grant(),
+            "$JS.API.CONSUMER.CREATE.*.*.$SWARM.term.*.sub.*"
+        );
     }
 
     #[test]