hive-matrix-mcp: quieter retries, unique snapshot tmp file, accurate comments

Audit follow-ups on the secondary-account retry.

The accounts snapshot is written by the heartbeat task and, now, by the
retry loop. Both used one fixed tmp path, so concurrent writers could
clobber it or fail the rename. Each write now names its own tmp file
(pid + counter); a test hammers it from four threads.

A permanently bad secondary logged three warnings per attempt, every 16
minutes, for as long as the daemon ran. DownAccounts::failed now reports
whether a failure is news (first, or a different reason from the last);
only that is a warning, repeats are debug. The two per-attempt warnings
in client.rs and credential.rs are covered by that line, which names the
reason, so the store-token one drops to debug.

The comments in client.rs and a credential.rs test, and persistence.md,
still described the old skip-until-restart behaviour or implied that a
store-listed account without a credential is retried here; that case is
handled by the linked-name set changing, not by this loop.

hive-matrix-mcp/src/client.rs

@@ -131,9 +131,10 @@ pub async fn build_and_restore(
                     }
                     std::process::exit(0);
                 }
-                // Secondary: token discarded (so it's cleanly skipped next boot
-                // rather than re-erroring); leave the sdk state in place in case
-                // the operator re-provisions a fresh token for the same device.
+                // Secondary: a file token is gone, a store token is untouched; the
+                // daemon tries the account again later and reads the token afresh.
+                // The sdk state stays in place in case the operator re-provisions a
+                // token for the same device.
                 // Return a PermanentBringUpError so the caller can distinguish
                 // "retrying now won't help" from a transient network/DNS failure.
                 return Err(anyhow::Error::new(PermanentBringUpError(