An agent makes its own forge unattended: account, token, spawn, first admin, by API and MCP #2929

Part of #2914 (one click from a stranger to their own forge).

Grokbot, or any agent with a token, does #2923 to #2928 with no browser:

1. POST /api/v1/users {username, password} makes the account. POST /api/v1/tokens with the password mints an expiring token (check whether this already exists).
2. POST /api/v1/forges {name, size, apps, dryRun:false, claim:"token"}: the parent claims the child for a headless first admin and returns that admin's expiring child token once, never stored and never in the idempotency table. The MCP spawn takes size and claim:"token", and its answer says plainly that the token is a live secret, as reveal does today.
3. The token works on https://<child>/api/v1/....

Done when a test does all three over HTTP alone, and docs/SPAWN.md and docs/MCP.md show the calls.

Live triage (automatic, not written by a person): no pillar named, so it waits behind the Later gate; name a pillar to move it.