hive-matrix-mcp: retry a secondary account that failed to come up

The daemon's two-minute refresh compared the store's linked account
names with the names it booted with. A secondary that was named but did
not come up - no token at bring-up, a token the homeserver rejected
(M_UNKNOWN_TOKEN), or a homeserver still down after the ~52 s boot
retries - kept its name in the set, so nothing ever noticed it again:
it stayed down until the daemon restarted for some other reason, and
an operator re-linking a rejected account changed no name.

Each such secondary is now tried again on the same two-minute period,
one per tick, after one refresh and then doubling waits capped at
sixteen minutes. One that comes up joins the registry (now behind a
lock) and its sync loop joins the running set; the primary and the
other accounts are not restarted. The store is still only read.

The startup todo wipe moves out of bring_up_account to run once before
any sync loop: run per account, a late secondary would have cleared the
todos the running accounts' sweeps had already deduped.

Part of #5017 (slice M).

nix/agent-modules/matrix.nix

@@ -99,7 +99,8 @@ in
               (for `main`, a file only when the store has no token: the
               swarm mints `main` into the store; an operator-supplied
               secret for an external one). The daemon
-              skips an extra account whose token file is absent, and
+              leaves an extra account whose token is absent down and tries
+              it again every few minutes, and
               exits cleanly to wait on the path watcher when `main`'s is.
             '';
           };
@@ -148,8 +149,9 @@ in
       - runs `hive-matrix-daemon` as a systemd unit that holds a
         matrix-sdk Client + sync per account against that account's
         homeserver (`homeserver`, else
-        `services.hyperhive.agent.matrix.url`). The daemon auto-skips an
-        account whose URL or token file is missing, and a `systemd.paths`
+        `services.hyperhive.agent.matrix.url`). The daemon leaves an
+        account whose URL or token is missing down (an extra one is tried
+        again every few minutes), and a `systemd.paths`
         watcher restarts it the moment a token file appears
         (same path-trigger shape as `forge-avatar-sync`).
       - exposes the matrix tool surface (send_message, send_dm,