swarm-controller: GET/PUT/DELETE /api/agents/{name}/limits

An agent's CPU and memory caps, set from the swarm. Keyed by the agent
alone, in a new `agent-limits` KV bucket that swarm-controller alone
writes, the same shape as `agent-inference` (#5034): mara on #4268,
"agents are not tied to a hive. dont tie the limits to the hive."

  PUT    {"cpu_quota": "400%", "memory_max": "8G"}   every field optional,
                                                     replaces the stored value
  GET    the stored caps, {} when there are none
  DELETE 204

PUT refuses an agent no hive's wanted state declares (as the inference
route does), unknown fields (422), zero and anything systemd does not take,
before the queue is asked, and stores memory in the spelling systemd takes
(8gb -> 8G). The hive hands these values to systemd verbatim.

The routes sit under /api/, behind the swarm UI vhost's authelia
subrequest like every sibling; the core-toggle module-eval case pins that
gate.

The bucket's reader on the hive comes in the next commit.

Contributes to #3865.

swarm-queue-client/src/lib.rs

@@ -216,6 +216,11 @@ pub mod agent_schedules;
 /// unconditional; writing needs `kv` and reading needs `agent-inference`.
 pub mod agent_inference;
 
+/// The bucket swarm-controller sets each agent's CPU and memory caps in — one
+/// key per agent, read by the hive that runs it. The names are unconditional;
+/// writing needs `kv` and reading needs `agent-limits`.
+pub mod agent_limits;
+
 #[cfg(feature = "kv")]
 mod kv;