agents: pull the forge token from bao; drop tea-login

forge-token.nix fetches swarm/agents/<agent>/forge-token under the
agent's own store identity into /run/hive-agent-forge-token/token, and
re-fetches on a timer so a rotation lands. hive-forge, the git
credential helper, hive-forge-notify, forge-avatar-sync and the web UI
read that file first and fall back to <state>/forge-token.

tea-login is deleted: it copied the token into ~/.config/tea, which
docs/swarm/credentials.md forbids for a store secret. hive-forge covers
the same verbs. swarmctl gains agent mint-forge-token.

Refs #3782

docs/networking/network.md

@@ -263,7 +263,7 @@ wiring is runtime:
 - the `hyperhive-isolated-dns` oneshot (`nix/agent-modules/network.nix`), gated on that
   marker, rewrites `/etc/resolv.conf` to `nameserver <gateway-ip>` at boot.
   It's ordered `before` the harness (`hive-ag3nt`), the matrix daemon, and
-  `tea-login` so the resolver is correct before the first DNS lookup.
+  the forge-token fetch so the resolver is correct before the first DNS lookup.
 
 **Why isolation is safe**: hive-c0re's control-plane sockets are unix
 domain sockets bind-mounted into containers, not network listeners — see

docs/process/conventions.md

@@ -502,13 +502,9 @@ sparingly) or build just the suspect check, for example `nix build
 ## Best-effort oneshot services
 
 The harness ships a family of one-shot systemd services that
-configure agent-side surfaces from values hive-c0re writes into
-the state dir at provisioning time:
+configure agent-side surfaces from values delivered to the agent at
+provisioning time:
 
-- `tea-login` — writes `~/.config/tea/config.yml` from the
-  `forge-token` written by `hive-c0re::forge::ensure_user_for`,
-  so `tea repos create` / `tea pulls create` work without
-  interactive prompts.
 - `forge-avatar-sync` — uploads `services.hyperhive.agent.icon` SVG to the
   agent's Forgejo profile, so the icon shows up on commits / PRs /
   issue comments.
@@ -538,13 +534,10 @@ Shape contract — every one of these:
    by the `.path` watchers that re-fire on token appearance (see
    `docs/agent-lifecycle/persistence.md::Matrix per-agent daemon`).
 
-The artefact lives under the agent user's home where applicable
-(`~/.config/tea/config.yml`) and is chown'd to that user, but the
-service itself stays root-owned so the bootstrap ordering doesn't
-need a user-existence check before each fire.
+The service stays root-owned so the bootstrap ordering doesn't need a
+user-existence check before each fire.
 
 This pattern keeps the rebuild path resilient: any failure inside
-these services degrades the corresponding surface (no tea config,
-no avatar) but never blocks the container from coming up. The
+these services degrades the corresponding surface (no avatar) but never blocks the container from coming up. The
 operator notices through `journalctl -u <unit>` rather than a
 broken switch-to-configuration.

docs/process/gotchas.md

@@ -448,7 +448,7 @@ connects to the compositor at `127.0.0.1:<vnc_port>`.
   must never block on weston signalling readiness. A misconfigured
   weston degrades to a `Restart=on-failure` loop visible in
   `journalctl`, it doesn't abort the `nixos-container update`.
-  Same reasoning as the `tea-login` unit in `nix/agent-modules/forge.nix`.
+  Same reasoning as the best-effort oneshots in `docs/process/conventions.md`.
 - **`[core] idle-time=0`**: disables weston's 300-second idle
   timeout. Without it the VNC desktop fades to black and
   desktop-shell shows its click-to-unlock screen — useless for an

docs/turn-loop/config.md

@@ -137,11 +137,9 @@ services.hyperhive.agent.forge.url = "http://forge.example:3000";  # default: nu
 services.hyperhive.agent.matrix.url = "https://matrix.example";    # default: null
 ```
 
-**`services.hyperhive.agent.forge.url`** — base URL of the Forgejo instance. Used by
-a one-shot boot unit (`tea-login`) that writes `~/.config/tea/config.yml`
-directly from the agent's `forge-token`, so `tea` and `hive-forge`
-work without an interactive auth step. The unit is a no-op when
-`forge-token` is absent. Override when the agent should connect to a
+**`services.hyperhive.agent.forge.url`** — base URL of the Forgejo instance. It scopes
+the git credential helper to this forge and is where `forge-avatar-sync`
+uploads the agent's icon. Override when the agent should connect to a
 Forgejo on a different host or port (for example a swarm peer's forge).
 Validated: must be an `http://` or `https://` URL, or `null`.
 
@@ -149,7 +147,7 @@ Validated: must be an `http://` or `https://` URL, or `null`.
 loopback default would only ever be correct when the forge shares the
 agent's network namespace, and inside a container `localhost` is the
 agent itself, so the default was a value that built fine and then talked
-to the wrong machine. With `null` the `tea-login` and `forge-avatar-sync`
+to the wrong machine. With `null` the credential helper and `forge-avatar-sync`
 units aren't generated at all: an absent integration rather than a
 misdirected one. You don't normally set this — hive-c0re renders the
 host's real forge URL into every agent, and refuses to write a meta