refactor(swarm-queue-client): extract the queue connect into a shared crate

A hive publishing its own status needs the same connect the controller
already has - mint an authelia token, present it at CONNECT for the
callout responder, let async-nats re-run the callback per attempt. Only
the use differs: the controller reads, a hive writes.

Copying it would put credential handling in two places, and a
token-refresh fix would then have to be found twice. That is the same
reasoning that already put hive-sock-client in its own crate rather than
in each daemon that speaks to a unix socket.

`from_env` takes a prefix rather than hardcoding SWARM_CONTROLLER_*: the
variables belong to the consuming unit, since a NixOS module sets them
alongside its other options. What is shared is the RULE - all four
together or none at all - not the spelling. The half-set case gains a
test, because it is the case the rule exists for and it previously had
none.

No jetstream/kv feature on the crate: it ends at a connected client, and
what a consumer does with it should be visible in that consumer's own
Cargo.toml.

Behaviour-preserving, and proven that way rather than by inspection: the
full behavioural gate (real nats-server, credential rotation, mutation)
is 20/0 unchanged, and the controller's own tests still pass.

Cargo.lock

@@ -4564,6 +4564,7 @@ dependencies = [
  "reqwest 0.13.1",
  "serde",
  "serde_json",
+ "swarm-queue-client",
  "tokio",
  "tracing",
  "tracing-subscriber",
@@ -4591,6 +4592,19 @@ dependencies = [
  "tracing-subscriber",
 ]
 
+[[package]]
+name = "swarm-queue-client"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "async-nats",
+ "reqwest 0.13.1",
+ "serde",
+ "serde_json",
+ "tokio",
+ "tracing",
+]
+
 [[package]]
 name = "swarmctl"
 version = "0.1.0"