swarm: put the matrix registration token where the reader is granted

`swarm-bao-matrix-token` reads `secret/swarm/matrix/registration-token`
and is refused with `Code: 403 — permission denied`, measured on this
host at 16:17:49Z after a successful cert login.

path.rs makes every swarm path `swarm/<kind>/<name>/…` where Kind is a
closed set of four: agents, hives, services, controller. `matrix` sits
where a kind belongs, so policy.rs's read document — which emits exactly
`swarm/agents/*` and `swarm/hives/<hive>/*` — cannot cover it. The
module's own doc predicted this: "a misspelled kind is a 403 at provision
time rather than anything a compiler sees".

Moves the token to `swarm/hives/<hive>/matrix/registration-token`, built
through principal_prefix(Kind::Hive, …) like its per-hive sibling
queue::agent_client_path. The policy is untouched: render already grants
that prefix. mara chose this over widening the namespace.

The nix reader interpolates hyperhiveCfg.hiveName, with the no-fallback
reasoning glue-bao-tls.nix already gives at its own use of it.

path.rs's MOUNT doc justified itself by citing the old literal, which
this commit deletes; rewritten to cite the nix reader instead.

Scope: this makes the read reachable, not the value present. Nothing
writes that path yet, and a 403 says nothing about presence — the two
are separate findings and only the first is fixed here. No migration:
nothing ever wrote the old path and no read ever succeeded.

Gate: cargo fmt 0, cargo test -p swarm-secret-client 0 — 32 passed
against a 29-passed baseline with the change stashed, so the three new
tests are accounted for rather than assumed.

Refs #4308

nix/host-modules/glue-matrix-bao-token.nix

@@ -42,7 +42,17 @@ let
   # Where the token lives in the store. A path, not a convention to guess at:
   # whoever writes it and whoever reads it must agree, and the agreement
   # belongs in one visible place.
-  tokenPath = "secret/swarm/matrix/registration-token";
+  #
+  # ⚠️ The `hives/<name>` segment is not decoration — it is what the reader's
+  # own grant covers. The store's read policy grants `swarm/agents/*` and
+  # `swarm/hives/<this hive>/*` and nothing else, so a path outside those is a
+  # 403 rather than a miss, however correct it looks. `swarm-secret-client`'s
+  # `matrix::registration_token_path` builds the same string from the same
+  # pieces; this literal is the nix half of that one agreement.
+  #
+  # `hiveName` has no fallback here for the reason ./glue-bao-tls.nix gives at
+  # its own use of it: it is asserted set for every hyperhive host.
+  tokenPath = "secret/swarm/hives/${hyperhiveCfg.hiveName}/matrix/registration-token";
 
   # A literal, not an option — ./hive-matrix.nix names its container
   # `containers.hive-matrix` directly and declares no `machine` to derive it