swarm-secret-client: say why the queue credential's client id is required

Pinning a decision rather than changing behaviour, because I was one
edit away from reversing it and left no reason on the field.

The sibling `matrix::Credential::homeserver` is an `Option`, which reads
like the house style to copy. It is not: that field is optional because
it was added to objects already in the store, and KV2 keeps those
versions forever. This path has never been written, so there is nothing
to stay compatible with.

Making it optional would also defeat the field. The id rides with the
secret so a reader never has to spell `hive-<name>-agent` itself, and
the only thing a reader holding `None` can do is exactly that. An object
without an id is not a usable credential, so failing to decode is the
behaviour we want.

Refs #3853

swarm-secret-client/src/queue.rs

@@ -39,6 +39,12 @@ pub struct Credential {
     pub value: String,
 
     /// The OIDC client id the secret authenticates.
+    ///
+    /// Required, unlike [`crate::matrix::Credential::homeserver`]: that field
+    /// is optional because it was added to objects already in the store, and
+    /// this path is new. An object without an id is not a usable credential,
+    /// so failing to decode is the wanted behaviour — the alternative is a
+    /// reader holding `None` whose only recourse is to spell the id itself.
     pub client_id: String,
 }