name the mint, not the publisher, as the writer of the client secrets

Finishes the sweep of prose that said the publisher unit writes or carries the OIDC client secrets: rust docs, nix comments and option descriptions, test names and docs.

nix/host-modules/hive-matrix.nix

@@ -1064,8 +1064,7 @@ in
           #
           # `Restart=on-failure` covers a sealed store or one still starting;
           # the timer below repeats the run, which a unit without `RemainAfterExit` allows.
-          # The start timeout is bounded for the reason
-          # ./swarm-secret-publisher.nix states: a sealed store answers on the
+          # The start timeout is bounded because a sealed store answers on the
           # port and never answers the read.
           systemd.services.swarm-matrix-appservice-sync = lib.mkIf ctlActive {
             description = "keep the swarm's appservice registration in step with the swarm secret store";