swarm-metrics-auth: remember a failed lookup briefly so a store outage costs one lookup per burst

After a failed or timed-out store read the responder denies for LOOKUP_FAILURE_WINDOW (3 s) without a new lookup, so a burst of requests during an outage costs one lookup instead of one per request.

Three edits besides the code in main.rs belong to this change:
- swarm-metrics-auth/Cargo.toml gains tokio's test-util dev-dependency because the burst test runs on paused time (start_paused) to let a hanging store sleep past LOOKUP_TIMEOUT without a real 5 s wait.
- docs/swarm/services.md gains the sentence that a failed or timed-out read is denied for three seconds without a retry, which documents the window this change adds.
- docs/swarm/credentials.md gains the clause "every three seconds while the store fails" on the Grafana bearer row, which documents the same window in the secrets table.

swarm-metrics-auth/Cargo.toml

@@ -23,3 +23,8 @@ tracing-subscriber.workspace = true
 
 [lints]
 workspace = true
+
+# `test-util` for `#[tokio::test(start_paused = true)]`: the lookup-timeout
+# test waits out `LOOKUP_TIMEOUT` on paused time.
+[dev-dependencies]
+tokio = { workspace = true, features = ["test-util"] }