add swarm-metrics, an agent CLI for the metrics store

swarm-metrics reads the swarm's VictoriaMetrics from inside an agent
container: query, query-range, series, labels and label-values, each one
GET against the store's Prometheus read API through the gateway, printing
the store's JSON. It authenticates the way swarm-logs does, with the
agent's own queue secret read from bao under the agent's leaf, sent as
a swarm-agent bearer.

On the metrics store's host the read API's auth map gains an agent arm
ahead of the Grafana one. It routes to swarm-metrics-agent-auth, a
swarm-logs-auth instance logged in under the existing swarm-metrics-auth
leaf, whose bao grant now includes swarm/agents/+/queue read. The check is
rate-limited per address like the log store's
(deploy.victoriametrics.agentAuth{Rate,Burst,VerdictTtl}).

nix/agent-modules/metrics.nix installs the wrapped binary when the hive
forwards HIVE_AGENT_METRICS_URL (from swarm.victoriametrics.domain) and a
store address, the same gate as swarm-logs. Adds the base:swarm-metrics
skill and the CLI reference with its freshness check.

Fixes #5395

hive-c0re/src/meta.rs

@@ -387,6 +387,8 @@ const FORWARDED_VARS: &[&str] = &[
     // same reason as the two above: it is a gateway address, and a container
     // cannot derive it from anything it holds.
     "HIVE_AGENT_LOGS_QUERY_URL",
+    // The metrics store's origin, for `swarm-metrics`, for the same reason.
+    "HIVE_AGENT_METRICS_URL",
     "HIVE_FORGE_URL",
     "HIVE_FORGE_PUBLIC_URL",
     "HIVE_MATRIX_URL",
@@ -433,6 +435,11 @@ const FORWARDED_VAR_OPTIONS: &[(&str, &str)] = &[
         "HIVE_AGENT_LOGS_QUERY_URL",
         "services.hyperhive.agent.logs.queryUrl",
     ),
+    // The same for `swarm-metrics`: see `nix/agent-modules/metrics.nix`.
+    (
+        "HIVE_AGENT_METRICS_URL",
+        "services.hyperhive.agent.metrics.url",
+    ),
     ("HIVE_FORGE_URL", "services.hyperhive.agent.forge.url"),
     ("HIVE_MATRIX_URL", "services.hyperhive.agent.matrix.url"),
     ("HYPERHIVE_SWARM_NAME", "services.hyperhive.agent.swarmName"),
@@ -1644,6 +1651,25 @@ mod tests {
         );
     }
 
+    /// `swarm-metrics` is installed only when the option is set, and reads
+    /// the env var at runtime, so the metrics store's origin needs both halves.
+    #[test]
+    fn the_metrics_url_is_forwarded_as_both_env_and_option() {
+        assert!(FORWARDED_VARS.contains(&"HIVE_AGENT_METRICS_URL"));
+        let mut out = String::new();
+        push_forwarded_var_options(
+            &mut out,
+            &[(
+                "HIVE_AGENT_METRICS_URL",
+                "https://metrics.t.local".to_string(),
+            )],
+        );
+        assert_eq!(
+            out,
+            "              services.hyperhive.agent.metrics.url = \"https://metrics.t.local\";\n"
+        );
+    }
+
     #[test]
     fn require_service_urls_accepts_a_rendered_forge_url() {
         require_service_urls(&[