swarm-nats-auth: re-read the OIDC client secret only on a 400 or 401

The responder re-read its secret on any non-2xx introspection answer.
With the re-read backoff added in the previous commit, an IdP outage
(503s, 502s from nginx, 429s) made each re-read find the unchanged
secret, so the delay grew to minutes. A real 401 after the rotation
then landed inside that window, and the responder denied every new
NATS connect until it ran out.

`Answer::Refused` now carries the status. `OidcSecret::introspect`
re-reads only when `stored_secret::is_credential_refusal` says the
status is 400 or 401, the same predicate `ClientSecret::refused` uses on
the client path. Every other non-2xx is a denial with no re-read.

The client-path test for a 429 now runs the mint against a loopback
endpoint answering 429 and 503, instead of calling `refused()` directly.
swarm-queue-client's README no longer names `ClientSecret::Value`.

Part of #5017 (slice Q).

swarm-queue-client/src/stored_secret.rs

@@ -205,6 +205,17 @@ impl Inner {
     }
 }
 
+/// Whether an `IdP` answering `status` refused the client's credential (400 or
+/// 401), the one answer a re-read can fix. A 429 or a 5xx says nothing about
+/// the secret, and re-reading on one would spend the backoff on an outage.
+#[must_use]
+pub fn is_credential_refusal(status: reqwest::StatusCode) -> bool {
+    matches!(
+        status,
+        reqwest::StatusCode::BAD_REQUEST | reqwest::StatusCode::UNAUTHORIZED
+    )
+}
+
 /// [`FIRST_REREAD_DELAY`] doubled per fruitless re-read after the first,
 /// capped at [`MAX_REREAD_DELAY`].
 fn delay_after(fruitless: u32) -> Duration {