move install_crypto_provider to swarm-secret-client

The rustls provider install is process setup every swarm binary runs, and
swarm-secret-client depends on no other swarm crate, so a binary that only
needs the provider and the store no longer links the queue client.

- swarm-secret-client/src/lib.rs, Cargo.toml: the function, its test, a
  `//!` line on why it lives there, and the rustls dependency; rustls
  `ring` as a dev-dependency feature, so the test builds both providers as
  the binaries do and fails if the install is dropped.
- swarm-queue-client/src/lib.rs, Cargo.toml: function and test removed;
  `connect()` calls the secret client's; rustls dropped (no other use),
  swarm-secret-client added.
- swarm-metrics-auth/Cargo.toml: drop swarm-queue-client, whose only use
  was the provider; the binary no longer links async-nats.
- swarm-logs-auth, swarm-logs, swarm-metrics, swarm-ci-metrics Cargo.toml:
  the dep comment no longer names the provider (they keep the dep for
  agent_token / the OIDC mint).
- Cargo.toml: the rustls comment names the provider's new home.
- 14 call sites (hive-agent, hive-c0re, hive-subagent-mcp x2,
  swarm-builder, swarm-ci-metrics, swarm-claude-login, swarm-controller,
  swarm-logs-auth, swarm-logs, swarm-metrics-auth, swarm-metrics,
  swarm-nats-auth, swarm-review-classifier): one-line path change.
- Cargo.lock: the dependency edges above.

swarm-logs/Cargo.toml

@@ -12,8 +12,7 @@ path = "src/main.rs"
 anyhow.workspace = true
 clap.workspace = true
 clap-markdown = "0.1"
-# The agent-token spelling the gateway's responder parses, and the rustls
-# provider the store client needs.
+# The agent-token spelling the gateway's responder parses.
 swarm-queue-client.workspace = true
 # The read of this agent's own queue secret.
 swarm-secret-client.workspace = true

swarm-logs/src/main.rs

@@ -85,7 +85,7 @@ fn main() -> Result<()> {
             // keep working on a machine that has no log store wired up at
             // all — `markdown-docs` in particular runs in a nix check, where
             // no credential exists and none should.
-            swarm_queue_client::install_crypto_provider();
+            swarm_secret_client::install_crypto_provider();
             let cfg = auth::Config::from_env()?;
             let stdout = std::io::stdout();
             query::run(&cfg, &logsql, limit, format, &mut stdout.lock())