add swarm-metrics, an agent CLI for the metrics store

swarm-metrics reads the swarm's VictoriaMetrics from inside an agent
container: query, query-range, series, labels and label-values, each one
GET against the store's Prometheus read API through the gateway, printing
the store's JSON. It authenticates the way swarm-logs does, with the
agent's own queue secret read from bao under the agent's leaf, sent as
a swarm-agent bearer.

On the metrics store's host the read API's auth map gains an agent arm
ahead of the Grafana one. It routes to swarm-metrics-agent-auth, a
swarm-logs-auth instance logged in under the existing swarm-metrics-auth
leaf, whose bao grant now includes swarm/agents/+/queue read. The check is
rate-limited per address like the log store's
(deploy.victoriametrics.agentAuth{Rate,Burst,VerdictTtl}).

nix/agent-modules/metrics.nix installs the wrapped binary when the hive
forwards HIVE_AGENT_METRICS_URL (from swarm.victoriametrics.domain) and a
store address, the same gate as swarm-logs. Adds the base:swarm-metrics
skill and the CLI reference with its freshness check.

Fixes #5395

nix/host-modules/swarm-bao.nix

@@ -1060,15 +1060,18 @@ let
     }
   ];
 
-  # The metrics store's responder, which checks the bearer Grafana presents
-  # against the one stored for it; and the host unit that fetches the store
-  # container's journal forwarder secret under the same leaf. Nothing else.
+  # The metrics store's responders under one leaf: the agent one checks the
+  # secret an agent presents against the one stored for it (the same `+` leaf
+  # as the log store's), the other checks the bearer Grafana presents; and the
+  # host unit that fetches the store container's journal forwarder secret.
+  # Nothing else.
   metricsAuthReaders = [
     {
       name = "swarm-metrics-auth";
       cn = baoDeploy.metricsAuthCommonName;
       policyText =
-        readStanza "${credentialMountPath}/data/${grafanaMetricsBearerLeaf}"
+        readStanza "${credentialMountPath}/data/swarm/agents/+/queue"
+        + readStanza "${credentialMountPath}/data/${grafanaMetricsBearerLeaf}"
         # The metrics store container's journal forwarder, fetched on its host.
         + readStanza "${credentialMountPath}/data/swarm/services/${hyperhiveCfg.swarm.victoriametrics.otel.clientId}/oidc/client";
     }
@@ -1977,8 +1980,9 @@ in
       default = "swarm-metrics-auth";
       description = ''
         Subject the store's `swarm-metrics-auth` cert-auth role accepts: the
-        identity the metrics store's Grafana auth responder presents to read
-        the bearer Grafana's datasource sends,
+        identity the metrics store's auth responders present to read agent
+        queue credentials, `swarm/agents/<agent>/queue`, and the bearer
+        Grafana's datasource sends,
         `swarm/services/<grafana client id>/metrics/bearer`, and the one
         `swarm-victoriametrics-forwarder-oidc` presents to read
         `swarm/services/<metrics store forwarder client id>/oidc/client`.