name the mint, not the publisher, as the writer of the client secrets

Finishes the sweep of prose that said the publisher unit writes or carries the OIDC client secrets: rust docs, nix comments and option descriptions, test names and docs.

nix/module-eval/grafana.nix

@@ -315,7 +315,7 @@ let
       # refused rather than empty, however correct it reads. The negative arm is
       # the rename this is exposed to — a secret filed under the hive that runs
       # the service instead of under the service itself.
-      name = "grafana's OIDC secret is read from the prefix the publisher writes";
+      name = "grafana's OIDC secret is read from the prefix the mint writes";
       ok =
         let
           s = grafanaRemoteAuthelia.systemd.services.swarm-bao-grafana-oidc.script;