fix(#3297): reject a publish template that names no hive

`--hive-publish-subject` exists to put a second stream inside one hive's
namespace. A template with no `{hive}` in it expands to the same subject
for every hive, so the option whose only purpose is scoping becomes the
way to remove it — silently, and only in the deployment that set it.

`Policy::new` returns a `Result` rather than checking at the call site:
that makes an unscoped policy unconstructible instead of merely
unlikely, the same reason `grant` takes its permissions by value. The
error names the offending template and says what goes wrong with it,
because an operator meets it at boot with no other context.

Also documents what the prefix match does not do. A client id is a hive
here because it starts with the configured prefix, not because it
appears in the roster — the responder runs in a container and cannot see
`swarm.hives`. Passing the roster in would close that and would also be
a second place deciding who may connect as what, which `introspect`'s
docs argue against for the same reason admission lives in one place.

The two intra-doc links to `open_or_create` become plain backticks.
Un-gating the `status` module means its module doc now renders in builds
without the `kv` feature, where the item it linked does not exist.

swarm-nats-auth/src/main.rs

@@ -130,12 +130,16 @@ async fn main() -> anyhow::Result<()> {
     // way for two deployments to disagree about which one that is. This
     // responder is the third end that names it, so it takes the same
     // constant rather than a copy of the literal.
+    // Fails the process rather than warning: a policy that cannot express a
+    // per-hive namespace is not a policy this responder should run with, and
+    // the queue's fail-closed state (no responder) is a legible outage where a
+    // silently over-broad grant is not.
     let policy = policy::Policy::new(
         args.hive_client_prefix.clone(),
         swarm_queue_client::status::BUCKET.to_owned(),
         args.reader_clients.clone(),
         args.hive_publish_subjects.clone(),
-    );
+    )?;
     let http = reqwest::Client::new();
     let issuer = nkeys::KeyPair::from_seed(&read_secret(&args.issuer_seed_file)?)
         .context("parse the account signing seed")?;