swarm-nats-auth: re-read the OIDC client secret only on a 400 or 401

The responder re-read its secret on any non-2xx introspection answer.
With the re-read backoff added in the previous commit, an IdP outage
(503s, 502s from nginx, 429s) made each re-read find the unchanged
secret, so the delay grew to minutes. A real 401 after the rotation
then landed inside that window, and the responder denied every new
NATS connect until it ran out.

`Answer::Refused` now carries the status. `OidcSecret::introspect`
re-reads only when `stored_secret::is_credential_refusal` says the
status is 400 or 401, the same predicate `ClientSecret::refused` uses on
the client path. Every other non-2xx is a denial with no re-read.

The client-path test for a 429 now runs the mint against a loopback
endpoint answering 429 and 503, instead of calling `refused()` directly.
swarm-queue-client's README no longer names `ClientSecret::Value`.

Part of #5017 (slice Q).

swarm-queue-client/README.md

@@ -44,9 +44,10 @@ The client secret is never in the environment, which would publish it to
 anything that can read `/proc/<pid>/environ`. A caller passes it either as a
 **path** (`ClientSecret::File`), read per token request rather than cached, so
 a rotation the operator believes took effect actually did, or as a value it
-fetched itself (`ClientSecret::Value`), held in memory. `swarm-controller` and
-`hive-c0re` both do the latter with the secret they read from the swarm's
-secret store.
+fetched itself (`ClientSecret::Stored`), held in memory and fetched again
+through the caller's callback when the token endpoint refuses it as a
+credential. `swarm-controller`, `hive-c0re` and `swarm-review-classifier` do the
+latter with the secret they read from the swarm's secret store.
 
 ## Token request shape: HTTP Basic, `audience`, `scope`