hivectl: drop forge create-user; SSO makes a human's forge account

The forge now creates a human's account on their first authelia login,
so the verb has no job left. Deletes it, HostRequest::ForgeCreateUser,
its handler, provision_user_token, change_user_password and the hive's
TOKEN_SCOPES. change_user_password also passed the password as an
argument to `forgejo admin user change-password`, so it showed in the
container's process list.

ensure_user_exists and mint_token stay for the `core` bootstrap, their
one caller now. ensure_user_exists loses its password parameter: only the
deleted path set one.

Refs #3782

hivectl/src/cli.rs

@@ -11,7 +11,7 @@ use std::path::PathBuf;
     long_about = "\
 Sibling to the `hive-c0re` daemon binary. Covers host-side admin \
 operations that don't go through the broker — manual user \
-provisioning on the bundled forge + matrix containers, plus future \
+provisioning on the bundled matrix container, plus future \
 recovery / debugging verbs.\
 "
 )]
@@ -28,11 +28,10 @@ pub struct Cli {
 
 #[derive(Subcommand)]
 pub enum Cmd {
-    /// Forgejo user provisioning.
+    /// Reconcile an agent's config between this hive and the forge.
     ///
-    /// Manual entry point to the same idempotent provisioning c0re runs at
-    /// boot — for recovery, ad-hoc reprovisioning, or fixing one agent
-    /// without bouncing the daemon.
+    /// A human's first SSO login to the forge makes their forge
+    /// account.
     Forge {
         #[command(subcommand)]
         cmd: ForgeCmd,
@@ -248,30 +247,6 @@ impl ScopeArgs {
 
 #[derive(Subcommand)]
 pub enum ForgeCmd {
-    /// Create or refresh a non-agent Forgejo account + token for `<name>`.
-    ///
-    /// Prints the token to stdout. Set a password to enable forge web-UI
-    /// login (otherwise it uses a random throwaway). Refused for an
-    /// existing agent: swarm-controller mints an agent's token
-    /// (`swarmctl agent mint-forge-token <agent>`).
-    CreateUser {
-        /// Forgejo username of a human/other account — `mara`,
-        /// `damocles`, etc.
-        name: String,
-        /// Set the account password to this string instead of a random
-        /// throwaway. Use this for operator accounts that need to log
-        /// into the forge web UI. Mutually exclusive with
-        /// `--password-stdin`. WARNING: the password is visible in
-        /// shell history + process listings; prefer `--password-stdin`
-        /// for anything sensitive.
-        #[arg(long)]
-        password: Option<String>,
-        /// Read the password from stdin (single line, trailing newline
-        /// stripped) instead of an inline flag. Mutually exclusive with
-        /// `--password`.
-        #[arg(long, conflicts_with = "password")]
-        password_stdin: bool,
-    },
     /// Show + reconcile the divergence between an agent's local applied
     /// config checkout and its forge `agent-configs/<agent>` main.
     ///