add swarm-metrics, an agent CLI for the metrics store

swarm-metrics reads the swarm's VictoriaMetrics from inside an agent
container: query, query-range, series, labels and label-values, each one
GET against the store's Prometheus read API through the gateway, printing
the store's JSON. It authenticates the way swarm-logs does, with the
agent's own queue secret read from bao under the agent's leaf, sent as
a swarm-agent bearer.

On the metrics store's host the read API's auth map gains an agent arm
ahead of the Grafana one. It routes to swarm-metrics-agent-auth, a
swarm-logs-auth instance logged in under the existing swarm-metrics-auth
leaf, whose bao grant now includes swarm/agents/+/queue read. The check is
rate-limited per address like the log store's
(deploy.victoriametrics.agentAuth{Rate,Burst,VerdictTtl}).

nix/agent-modules/metrics.nix installs the wrapped binary when the hive
forwards HIVE_AGENT_METRICS_URL (from swarm.victoriametrics.domain) and a
store address, the same gate as swarm-logs. Adds the base:swarm-metrics
skill and the CLI reference with its freshness check.

Fixes #5395

CLAUDE.md

@@ -138,10 +138,11 @@ Swarm-level:
   token against the store; shared by `swarm-nats-auth` and
   `swarm-logs-auth`.
 - **`swarm-logs-auth/`** — nginx `auth_request` responder for agent access
-  to the log store.
+  to the log store, and to the metrics store as `swarm-metrics-agent-auth`.
 - **`swarm-metrics-auth/`** — nginx `auth_request` responder for Grafana's
   bearer on the metrics store's query API.
 - **`swarm-logs/`** — agent CLI: a LogsQL query in, log lines out.
+- **`swarm-metrics/`** — agent CLI: a MetricsQL query in, the store's JSON out.
 - **`swarm-matrix-client/`** — appservice calls against the swarm
   homeserver, shared by `swarm-controller` and `swarm-matrix-ctl`.
 - **`swarm-matrix-ctl/`** — the one binary run inside