swarm-nats-auth: take the subscribe subjects from the shared definitions

The reader's subscribe allow-list spelled `$SWARM.term.*`,
`$SWARM.term.*.sub.*` and `$SWARM.agent-state.*` as literals, copies of
private prefixes in hive-agent and swarm-controller. A rename on either side
left the policy behind and the stream stopped with only a connection-level
server error.

swarm-queue-client now owns `term_subject`, `agent_state_subject` and their
`*_wildcard` forms, and `subagent_term::subject_wildcard`; hive-agent's
publishers, swarm-controller's relays and the policy all build from them.
Subjects are byte-identical.

swarm-queue-client/src/lib.rs

@@ -272,6 +272,47 @@ pub const AGENT_INPUT_SUBJECT_WILDCARD: &str = "$SWARM.input.*";
 /// Shared by [`agent_input_subject`] and [`AGENT_INPUT_SUBJECT_WILDCARD`].
 const AGENT_INPUT_SUBJECT_PREFIX: &str = "$SWARM.input";
 
+/// The subject `agent` publishes its terminal rows on. One leaf per agent, so
+/// a subscriber can follow one agent without filtering the swarm's whole
+/// terminal traffic.
+///
+/// Shared by the publisher (`hive-agent`), the relay that streams it to
+/// swarm-ui (`swarm-controller`) and the queue's subscribe grant for readers
+/// (`swarm-nats-auth`), which spells [`term_subject_wildcard`] — so a rename
+/// moves all three together.
+#[must_use]
+pub fn term_subject(agent: &str) -> String {
+    format!("{TERM_SUBJECT_PREFIX}.{agent}")
+}
+
+/// Every [`term_subject`] at once: the reader's subscribe grant, which has no
+/// roster to enumerate agents from.
+#[must_use]
+pub fn term_subject_wildcard() -> String {
+    term_subject("*")
+}
+
+/// Shared by [`term_subject`] and [`subagent_term`], whose subjects sit under
+/// the same prefix.
+const TERM_SUBJECT_PREFIX: &str = "$SWARM.term";
+
+/// The subject `agent` publishes its turn-state header on. Same shape and
+/// same three users as [`term_subject`].
+#[must_use]
+pub fn agent_state_subject(agent: &str) -> String {
+    format!("{AGENT_STATE_SUBJECT_PREFIX}.{agent}")
+}
+
+/// Every [`agent_state_subject`] at once, for the same reason as
+/// [`term_subject_wildcard`].
+#[must_use]
+pub fn agent_state_subject_wildcard() -> String {
+    agent_state_subject("*")
+}
+
+/// Shared by [`agent_state_subject`] and its wildcard.
+const AGENT_STATE_SUBJECT_PREFIX: &str = "$SWARM.agent-state";
+
 /// The reply-inbox prefix a client presenting `agent`'s own credential
 /// connects with.
 ///
@@ -915,6 +956,16 @@ where
 mod tests {
     use super::*;
 
+    /// The names the publishers, the relays and the queue's grant all spell.
+    #[test]
+    fn term_and_agent_state_subjects_are_the_agreed_names() {
+        assert_eq!(term_subject("mara"), "$SWARM.term.mara");
+        assert_eq!(term_subject_wildcard(), "$SWARM.term.*");
+        assert_eq!(agent_state_subject("mara"), "$SWARM.agent-state.mara");
+        assert_eq!(agent_state_subject_wildcard(), "$SWARM.agent-state.*");
+        assert_eq!(subagent_term::subject_wildcard(), "$SWARM.term.*.sub.*");
+    }
+
     #[test]
     fn a_tls_client_config_builds_once_the_provider_is_installed() {
         install_crypto_provider();