move install_crypto_provider to swarm-secret-client

The rustls provider install is process setup every swarm binary runs, and
swarm-secret-client depends on no other swarm crate, so a binary that only
needs the provider and the store no longer links the queue client.

- swarm-secret-client/src/lib.rs, Cargo.toml: the function, its test, a
  `//!` line on why it lives there, and the rustls dependency; rustls
  `ring` as a dev-dependency feature, so the test builds both providers as
  the binaries do and fails if the install is dropped.
- swarm-queue-client/src/lib.rs, Cargo.toml: function and test removed;
  `connect()` calls the secret client's; rustls dropped (no other use),
  swarm-secret-client added.
- swarm-metrics-auth/Cargo.toml: drop swarm-queue-client, whose only use
  was the provider; the binary no longer links async-nats.
- swarm-logs-auth, swarm-logs, swarm-metrics, swarm-ci-metrics Cargo.toml:
  the dep comment no longer names the provider (they keep the dep for
  agent_token / the OIDC mint).
- Cargo.toml: the rustls comment names the provider's new home.
- 14 call sites (hive-agent, hive-c0re, hive-subagent-mcp x2,
  swarm-builder, swarm-ci-metrics, swarm-claude-login, swarm-controller,
  swarm-logs-auth, swarm-logs, swarm-metrics-auth, swarm-metrics,
  swarm-nats-auth, swarm-review-classifier): one-line path change.
- Cargo.lock: the dependency edges above.

swarm-secret-client/Cargo.toml

@@ -12,6 +12,9 @@ reqwest.workspace = true
 # implement — see `client::WriteAclPolicy`.
 rustify.workspace = true
 rustify_derive.workspace = true
+# `install_crypto_provider`, which the store client (reqwest, via vaultrs)
+# needs before its first TLS handshake.
+rustls.workspace = true
 serde.workspace = true
 # `read_versioned` decodes the data half of the response vaultrs hands back as
 # a `serde_json::Value`.
@@ -22,3 +25,9 @@ vaultrs.workspace = true
 
 [lints]
 workspace = true
+
+# `ring` as well, as every binary that links async-nats builds it: with one
+# provider compiled in rustls picks it without an install, so the provider
+# test would pass with `install_crypto_provider` doing nothing.
+[dev-dependencies]
+rustls = { workspace = true, features = ["ring"] }

swarm-secret-client/src/lib.rs

@@ -24,6 +24,10 @@
 //!
 //! [`mtls`] is the one module about reaching the store rather than about a
 //! value inside it, and its doc explains why that is not circular.
+//!
+//! [`install_crypto_provider`] is process setup, not an agreement. It lives
+//! here because this crate depends on no other swarm crate, so a binary that
+//! needs only the provider and the store links nothing else.
 
 pub mod acp;
 pub mod builder;
@@ -105,3 +109,30 @@ impl From<vaultrs::error::ClientError> for Error {
         Self::Vault(Box::new(e))
     }
 }
+
+/// Install `aws-lc-rs` as the process-wide rustls crypto provider. Call it
+/// first thing in `main` of every binary that dials the queue or reaches the
+/// secret store over TLS.
+///
+/// rustls is built with both `ring` and `aws-lc-rs`; without an installed
+/// default, the first TLS handshake panics. On the queue side async-nats
+/// builds its config with `ClientConfig::builder()`, so the client never
+/// connects. On the store side the client is reqwest, via vaultrs.
+/// `aws-lc-rs` because it is what reqwest uses when nothing is installed.
+pub fn install_crypto_provider() {
+    // `Err` only means a provider is already installed, which is all this needs.
+    let _already_installed = rustls::crypto::aws_lc_rs::default_provider().install_default();
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_tls_client_config_builds_once_the_provider_is_installed() {
+        install_crypto_provider();
+        let _config = rustls::ClientConfig::builder()
+            .with_root_certificates(rustls::RootCertStore::empty())
+            .with_no_client_auth();
+    }
+}