move agent_token from swarm-queue-client to swarm-agent-verify

per #5471, verifiers stop depending on the queue client. the module is
store-free and needs only thiserror, so swarm-agent-verify gains one
dependency and loses its swarm-queue-client edge. consumers import it
from swarm_agent_verify; swarm-logs and swarm-metrics, whose only use of
swarm-queue-client was this module, drop that dependency, as does
swarm-logs-auth.

swarm-logs/Cargo.toml

@@ -13,7 +13,7 @@ anyhow.workspace = true
 clap.workspace = true
 clap-markdown = "0.1"
 # The agent-token spelling the gateway's responder parses.
-swarm-queue-client.workspace = true
+swarm-agent-verify.workspace = true
 # The read of this agent's own queue secret.
 swarm-secret-client.workspace = true
 # Only to drive that one async read; the query itself is blocking.

swarm-logs/README.md

@@ -25,7 +25,7 @@ As the agent itself. On each query it reads the agent's own queue secret,
 store certificate (`nix/agent-modules/bao.nix`), the same read `hive-agent`
 makes for its queue connection. It sends the secret as
 `Authorization: Bearer swarm-agent.<agent>.<secret>`, spelled by
-`swarm_queue_client::agent_token`.
+`swarm_agent_verify::agent_token`.
 
 At the gateway, nginx hands a bearer of that shape to `swarm-logs-auth`, which
 compares it with the stored secret (`swarm-agent-verify`, the check the queue's

swarm-logs/src/auth.rs

@@ -5,7 +5,7 @@
 //! The read is `hive-agent`'s `swarm_queue` one: the same variables, the same
 //! path (`swarm/agents/<agent>/queue`) and the same cert-auth role. The secret
 //! goes out as `Bearer swarm-agent.<agent>.<secret>`, spelled by
-//! `swarm_queue_client::agent_token`; the gateway's `swarm-logs-auth`
+//! `swarm_agent_verify::agent_token`; the gateway's `swarm-logs-auth`
 //! responder checks it against the store.
 //!
 //! 🩸 The secret is never logged and never rendered into an error.
@@ -87,7 +87,7 @@ impl Config {
                 .with_context(|| format!("reading {}", self.path))
         })?;
         let stored = stored.with_context(|| format!("nothing is stored at {}", self.path))?;
-        swarm_queue_client::agent_token::format_agent_token(&self.agent, &stored.value)
+        swarm_agent_verify::agent_token::format_agent_token(&self.agent, &stored.value)
             .with_context(|| format!("spelling the credential stored at {}", self.path))
     }
 }