swarm-nats-auth: bound the OIDC secret re-read, and test the 401 that starts it

The re-read of the responder's own OIDC client secret had no timeout:
neither swarm-secret-client nor vaultrs nor reqwest sets one by default,
and while a re-read runs every later refusal joins it rather than
starting another. A store connection whose peer stays alive but silent
therefore held off rotation pickup indefinitely. The spawned re-read
now gives up after 10 s, logs that it did (without the secret), keeps
the secret in use, and frees the slot for the next refusal's re-read.

The link from a non-2xx introspection (identify_caller's
`Answer::Refused`) to that re-read had no test: every existing test
handed `OidcSecret::introspect` an `Answer` directly. A new test runs
the real `identify_caller` against a loopback IdP that answers 401 to
the old secret and admits the new one, so mapping a non-2xx to
anything but `Refused` turns it red. axum is a dev-dependency for that
stub, as in swarm-controller's forge tests.

swarm-nats-auth/Cargo.toml

@@ -39,6 +39,9 @@ tracing.workspace = true
 tracing-subscriber.workspace = true
 
 [dev-dependencies]
+# A loopback stand-in `IdP` for `oidc_secret`'s test of a non-2xx
+# introspection starting the re-read.
+axum.workspace = true
 # A TEST ORACLE, not part of the production path. Neither JWT this crate emits
 # is expressible through it - `Claims` has no `aud`, which the response wrapper
 # needs (the server id) and the user token needs (the account name), and