fix(swarm): name the account by aud, never issuer_account

The responder answered granted=true and the server still refused every
client:

  Error non operator mode account "AUTH": attempted to use issuer_account

nats_jwt::Token::new_user always sets issuer_account, which is an
operator-mode field naming the account when a signing key rather than the
account identity key signed the token. In server-config mode - what this
module renders - its mere presence is fatal, and the account is named by
the claims' aud instead.

nats-jwt can express neither aud nor the omission, so the user JWT is now
hand-built by the same signer as the response wrapper, and nats-jwt moves
to dev-dependencies as the encoder's test oracle.

Every unit test passed throughout: they assert fields that must be
present, and the defect was a field that must be absent.

nix/host-modules/swarm-nats.nix

@@ -363,6 +363,11 @@ in
                 "--issuer-seed-file \${CREDENTIALS_DIRECTORY}/issuer.seed"
                 "--client-secret-file \${CREDENTIALS_DIRECTORY}/oidc-client.secret"
                 "--client-id ${lib.escapeShellArg cfg.clientId}"
+                # The account admitted clients land in, by NAME: in
+                # server-config mode the server resolves `aud` against its
+                # own `accounts` block, so this and the block above have to
+                # be the same string — which is why both come from one let.
+                "--account ${lib.escapeShellArg clientAccount}"
                 "--introspection-url ${lib.escapeShellArg introspectionUrl}"
               ];
               # Every credential arrives by `LoadCredential` and is named