swarm-controller: GET/PUT/DELETE /api/agents/{name}/limits

An agent's CPU and memory caps, set from the swarm. Keyed by the agent
alone, in a new `agent-limits` KV bucket that swarm-controller alone
writes, the same shape as `agent-inference` (#5034): mara on #4268,
"agents are not tied to a hive. dont tie the limits to the hive."

  PUT    {"cpu_quota": "400%", "memory_max": "8G"}   every field optional,
                                                     replaces the stored value
  GET    the stored caps, {} when there are none
  DELETE 204

PUT refuses an agent no hive's wanted state declares (as the inference
route does), unknown fields (422), zero and anything systemd does not take,
before the queue is asked, and stores memory in the spelling systemd takes
(8gb -> 8G). The hive hands these values to systemd verbatim.

The routes sit under /api/, behind the swarm UI vhost's authelia
subrequest like every sibling; the core-toggle module-eval case pins that
gate.

The bucket's reader on the hive comes in the next commit.

Contributes to #3865.

swarm-controller/README.md

@@ -52,6 +52,11 @@ The swarm's control plane. The swarm UI and `swarmctl` are its clients.
   agent applies them itself. `GET` also answers the model and effort the
   agent last reported in its turn-state header, kept in memory →
   [`docs/swarm/inference.md`](../docs/swarm/inference.md).
+- **Resource caps** — each agent's CPU and memory cap, one key per agent in
+  the `agent-limits` KV bucket, which this daemon alone writes
+  (`GET`/`PUT`/`DELETE /api/agents/{name}/limits`); the hive running the
+  agent reads it, and each cap replaces the hive's own answer for that field →
+  [`docs/scheduler/coordinator.md`](../docs/scheduler/coordinator.md#container-resource-limits).
 - **Relays** — each agent's terminal and turn-state header as SSE, agent
   icons, the cross-repo issue report, and the UI's quick links.