move install_crypto_provider to swarm-secret-client

The rustls provider install is process setup every swarm binary runs, and
swarm-secret-client depends on no other swarm crate, so a binary that only
needs the provider and the store no longer links the queue client.

- swarm-secret-client/src/lib.rs, Cargo.toml: the function, its test, a
  `//!` line on why it lives there, and the rustls dependency; rustls
  `ring` as a dev-dependency feature, so the test builds both providers as
  the binaries do and fails if the install is dropped.
- swarm-queue-client/src/lib.rs, Cargo.toml: function and test removed;
  `connect()` calls the secret client's; rustls dropped (no other use),
  swarm-secret-client added.
- swarm-metrics-auth/Cargo.toml: drop swarm-queue-client, whose only use
  was the provider; the binary no longer links async-nats.
- swarm-logs-auth, swarm-logs, swarm-metrics, swarm-ci-metrics Cargo.toml:
  the dep comment no longer names the provider (they keep the dep for
  agent_token / the OIDC mint).
- Cargo.toml: the rustls comment names the provider's new home.
- 14 call sites (hive-agent, hive-c0re, hive-subagent-mcp x2,
  swarm-builder, swarm-ci-metrics, swarm-claude-login, swarm-controller,
  swarm-logs-auth, swarm-logs, swarm-metrics-auth, swarm-metrics,
  swarm-nats-auth, swarm-review-classifier): one-line path change.
- Cargo.lock: the dependency edges above.

swarm-secret-client/Cargo.toml

@@ -12,6 +12,9 @@ reqwest.workspace = true
 # implement — see `client::WriteAclPolicy`.
 rustify.workspace = true
 rustify_derive.workspace = true
+# `install_crypto_provider`, which the store client (reqwest, via vaultrs)
+# needs before its first TLS handshake.
+rustls.workspace = true
 serde.workspace = true
 # `read_versioned` decodes the data half of the response vaultrs hands back as
 # a `serde_json::Value`.
@@ -22,3 +25,9 @@ vaultrs.workspace = true
 
 [lints]
 workspace = true
+
+# `ring` as well, as every binary that links async-nats builds it: with one
+# provider compiled in rustls picks it without an install, so the provider
+# test would pass with `install_crypto_provider` doing nothing.
+[dev-dependencies]
+rustls = { workspace = true, features = ["ring"] }