docs(tools): add hivectl.md — operator host CLI reference

hivectl has verbs scattered across CLAUDE.md and domain docs (gateway.md
has the gateway subcommands, matrix.md has a brief mention) but no
single cheatsheet. Add docs/tools/hivectl.md covering all subcommands:

- forge create-user: provision/refresh agent or human forge accounts
- matrix create-user / sync-admin / promote-user / reset-password
- gateway create-user / delete-user / list-users (htpasswd management)
- agents restart / restart-all (container lifecycle via admin socket)
- choom <name> [--fresh]: interactive claude session in agent container

Also add a reading-path entry to CLAUDE.md pointing at the new file.

CLAUDE.md

@@ -423,6 +423,9 @@ read them à la carte.
 - **"What verbs does `hive-forge` support? How do I post a comment,
   upload an attachment, manage subscriptions?"** →
   [`docs/tools/forge.md`](docs/tools/forge.md).
+- **"What does `hivectl` do? How do I provision a forge/matrix account,
+  manage gateway users, restart containers, or drop into an agent shell?"** →
+  [`docs/tools/hivectl.md`](docs/tools/hivectl.md).
 - **"How does the matrix-tuwunel container work? What about
   fluffychat-web and per-agent matrix accounts?"** →
   [`docs/matrix.md`](docs/matrix.md).