swarm-nats-auth: a review classifier hears try-outs and answers by reply only

swarm-queue-client gains review_classifier: the try-out subject, the
request and reply that travel on it, and the deadlines both ends share.
The controller's reader grant may publish the subject; a client named
with --review-classifier-client may subscribe to it and its inbox, and
answers under NATS allow_responses (resp in the user JWT) within the
run deadline. Every other client id is still denied.

swarm-queue-client/src/lib.rs

@@ -392,6 +392,11 @@ pub mod agent_term;
 /// feature; the names are unconditional, like [`agent_icon`]'s.
 pub mod subagent_term;
 
+/// The review classifier's try-out subject and the request and reply it
+/// carries. The `schema` feature adds `ToSchema` for an HTTP API serving the
+/// same shapes.
+pub mod review_classifier;
+
 /// Only the fields this needs; authelia returns several.
 #[derive(serde::Deserialize)]
 struct TokenResponse {