add swarm-metrics, an agent CLI for the metrics store

swarm-metrics reads the swarm's VictoriaMetrics from inside an agent
container: query, query-range, series, labels and label-values, each one
GET against the store's Prometheus read API through the gateway, printing
the store's JSON. It authenticates the way swarm-logs does, with the
agent's own queue secret read from bao under the agent's leaf, sent as
a swarm-agent bearer.

On the metrics store's host the read API's auth map gains an agent arm
ahead of the Grafana one. It routes to swarm-metrics-agent-auth, a
swarm-logs-auth instance logged in under the existing swarm-metrics-auth
leaf, whose bao grant now includes swarm/agents/+/queue read. The check is
rate-limited per address like the log store's
(deploy.victoriametrics.agentAuth{Rate,Burst,VerdictTtl}).

nix/agent-modules/metrics.nix installs the wrapped binary when the hive
forwards HIVE_AGENT_METRICS_URL (from swarm.victoriametrics.domain) and a
store address, the same gate as swarm-logs. Adds the base:swarm-metrics
skill and the CLI reference with its freshness check.

Fixes #5395

nix/checks.nix

@@ -478,6 +478,21 @@ in
         touch "$out"
       '';
 
+  # `swarm-metrics` CLI reference freshness check, the same shape as
+  # `swarm-logs-docs` above.
+  swarm-metrics-docs =
+    pkgs.runCommand "swarm-metrics-docs-fresh" { nativeBuildInputs = [ pkgs.diffutils ]; }
+      ''
+        ${self.packages.${system}.swarm-metrics}/bin/swarm-metrics markdown-docs > generated.md
+        if ! diff -u ${../docs/tools/swarm-metrics-cli.md} generated.md; then
+          echo "" >&2
+          echo "ERROR: docs/tools/swarm-metrics-cli.md is out of date — regenerate it:" >&2
+          echo "  nix build .#swarm-metrics && ./result/bin/swarm-metrics markdown-docs > docs/tools/swarm-metrics-cli.md" >&2
+          exit 1
+        fi
+        touch "$out"
+      '';
+
   # `hive-forge` CLI reference freshness check — same shape as
   # `hivectl-docs` above, `hive-forge markdown-docs` (clap-markdown over
   # its own command tree) instead. Reuses `packages.<system>.hive-forge`