matrix: one sender account and one sender token per hive

A swarm runs one homeserver and every hive on it logged in as the same
`@hive:` localpart, holding the same access token out of one swarm-wide
store path. That is one matrix identity for N hives: the homeserver
cannot attribute an action to the hive that took it, and revoking one
hive's standing revokes every hive's.

Three changes, and the third is the one that makes the other two real:

- **The localpart carries the hive's name** (`hive-<hive>`), derived in
  one place, `swarm_secret_client::matrix::hive_localpart`.
  `hive-matrix.nix` renders the same string as the appservice
  registration's `sender_localpart`, so the shared account stops being
  created rather than merely stops being used.
- **The store path is templated by hive**, not a constant. The
  "a swarm runs one homeserver, so this is a constant rather than a
  parameter" rationale went with it; it stopped holding the moment two
  hives shared the homeserver it describes.
- **The path moved out from under the grant every hive has.** It sat at
  `swarm/services/matrix/sender-token`, inside the
  `secret/data/swarm/services/*` read stanza `policy::render` gives every
  hive. It now sits under that hive's own stanza,
  `secret/data/swarm/hives/<hive>/*`, which interpolates the reader's
  name — so a hive reads its own token and is refused another's. The
  policy renderer itself is unchanged: narrowing the `services/*` grant
  would break the OIDC-secret read it exists for, and moving the
  credential is what this needed instead. A policy test walks the
  rendered stanzas and asserts none of hive alpha's covers hive beta's
  sender token, so a later stanza that widened it fails here.

`swarm-matrix-ctl` takes a new required `MATRIX_MINT_HIVE` and writes
that hive's path; its store grant in `swarm-bao.nix` follows, scoped to
one hive's leaf via the new `deploy.bao.matrixCtlHiveName` (defaulting to
this host's `hiveName`) rather than a `hives/*` wildcard, which would
hand the matrix container every hive's token back.

Migration: no outage at deploy. `ensure_hive_user` short-circuits on the
local token file, so a hive keeps running on what it has; with no such
file it reads the new per-hive path, finds nothing, and falls through to
the existing register-or-appservice-login ladder against its own
localpart — which needs only the per-hive `as_token` on local disk. The
old shared object is read by nothing afterwards. Rooms do not follow the
identity, and that is the one operator step; both ways out are written
into `docs/integrations/matrix.md`.

No admin standing is granted to the per-hive accounts: `admin_execute`
stays empty and the assertion pinning it is untouched.

swarm-secret-client/src/policy.rs

@@ -24,10 +24,10 @@
 //! The **hive** stanza has no such problem and is therefore narrow: that path
 //! names its principal, so scoping it to the reader's own name costs nothing
 //! and drifts nowhere. Do not widen it to match its neighbours — the asymmetry
-//! is the point.
+//! is the point, and only holds if a one-per-hive credential is stored under
+//! [`Kind::Hive`], not [`Kind::Service`] — see docs/trust-boundary/security.md.
 //!
-//! Rendering stays separate from writing so the text can be asserted with no
-//! store to talk to.
+//! Rendering stays separate from writing so the text can be asserted with no store to talk to.
 
 use crate::{
     Error,
@@ -251,6 +251,60 @@ mod tests {
         );
     }
 
+    /// 🩸 The per-hive matrix sender-token scoping, asserted on the rendered
+    /// document rather than on the path function alone: it is the policy text
+    /// that decides what a hive may fetch, so "the path is per-hive" only
+    /// means something if the stanza that reaches it is too.
+    ///
+    /// The `services/*` stanza above is deliberate and stays — it is how a
+    /// host reads the OIDC secret of a service it runs. The property here is
+    /// that the matrix sender token is no longer *inside* it.
+    #[test]
+    fn a_hive_reaches_its_own_matrix_sender_token_and_no_other_hives() {
+        let alpha = render("alpha").expect("legal");
+        let own = crate::matrix::sender_token_path("alpha").expect("legal");
+        let other = crate::matrix::sender_token_path("beta").expect("legal");
+
+        // Reachable: the hive's own stanza is the prefix of its own path.
+        assert!(
+            alpha.contains("path \"secret/data/swarm/hives/alpha/*\""),
+            "{alpha}"
+        );
+        assert!(own.starts_with("swarm/hives/alpha/"), "{own}");
+
+        // Unreachable: no stanza in alpha's document is a prefix of beta's
+        // path. Checked by walking the stanzas rather than by asserting the
+        // absence of the string "beta", so a future stanza that happened to
+        // cover it — `swarm/hives/*`, say — would fail this too.
+        assert!(
+            !stanza_paths(&alpha)
+                .iter()
+                .any(|granted| covers(granted, &other)),
+            "alpha's document reaches {other}:\n{alpha}"
+        );
+    }
+
+    /// Every `path "…"` a rendered document grants, with the `secret/data/`
+    /// ACL prefix stripped so it compares against a store path.
+    fn stanza_paths(document: &str) -> Vec<String> {
+        document
+            .lines()
+            .filter_map(|line| line.strip_prefix("path \""))
+            .filter_map(|rest| rest.split('"').next())
+            .filter_map(|p| p.strip_prefix("secret/data/"))
+            .map(str::to_owned)
+            .collect()
+    }
+
+    /// Does a granted policy path cover `path`? Only the trailing-`*` form
+    /// this module renders, which is the only form it has to understand.
+    fn covers(granted: &str, path: &str) -> bool {
+        match granted.strip_suffix('*') {
+            Some(prefix) => path.starts_with(prefix),
+            None => granted == path,
+        }
+    }
+
     #[test]
     fn the_grant_is_read_only() {
         // A hive reads credentials; a hive that could write one could hand