fix(#3344): type the roster entry's name as Ident, per review

A bare String in a crate whose whole suite types validated names as
hive_types::Ident, so a consumer had to re-derive at the boundary what every
sibling field gets checked for free.

Ident is strictly narrower than the store's charset — [a-z0-9-] against the
[A-Za-z0-9._-] the users database allows, because that file holds humans too.
Every agent name is a legal Ident by construction (creation parses one before
the job is queued), so the narrowing costs real agents nothing. What it does
mean is that a human hand-added to the agent group cannot be described as an
agent: the reader omits that row and logs it, rather than failing the whole
roster or quietly shrinking the answer.

The REQUEST keeps its String. That side carries what a caller asked for, and
validating it server-side is what lets a bad name be refused with a message
instead of failing to deserialise.

swarm-authelia-bridge-sock/src/lib.rs

@@ -25,6 +25,7 @@
 //! file blob — that would invite a last-writer-wins race between independent
 //! callers and duplicate the rendering logic on both sides of the wire.
 
+use hive_types::Ident;
 use serde::{Deserialize, Serialize};
 
 /// A request to the bridge — see the module doc for why this isn't a
@@ -69,7 +70,20 @@ pub enum BridgeRequest {
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct AgentIdentity {
     /// The authelia username, which is the agent's name.
-    pub name: String,
+    ///
+    /// [`Ident`] rather than a bare `String`, so a consumer gets the same
+    /// serde-checked parsing at the socket boundary that every other
+    /// agent-name field in the crate suite does.
+    ///
+    /// ⚠️ **It is deliberately NARROWER than what the store accepts.**
+    /// `Ident` is `[a-z0-9-]`; the users database also admits `.`, `_` and
+    /// uppercase, because it holds humans too. Every *agent* name is a valid
+    /// `Ident` by construction — agent creation parses one before the job is
+    /// queued — so the narrowing costs nothing for real agents and refuses to
+    /// describe a human who was hand-added to the agent group as though they
+    /// were one. The reader skips such an entry and logs it; see the bridge's
+    /// `list`.
+    pub name: Ident,
 }
 
 /// The bridge's answer to a [`BridgeRequest`].
@@ -109,6 +123,7 @@ pub enum BridgeResponse {
 #[cfg(test)]
 mod tests {
     use super::{AgentIdentity, BridgeRequest, BridgeResponse};
+    use hive_types::Ident;
 
     /// Pins the external-tag wire shape — a reader off the wire (or a log
     /// line) should be able to tell the outcomes apart without
@@ -128,7 +143,7 @@ mod tests {
 
         let agents = serde_json::to_value(BridgeResponse::Agents {
             agents: vec![AgentIdentity {
-                name: "atlas".to_owned(),
+                name: Ident::parse("atlas").expect("valid ident"),
             }],
         })
         .unwrap();
@@ -149,6 +164,11 @@ mod tests {
 
     #[test]
     fn request_round_trips() {
+        // Still a `String`: the REQUEST carries whatever the caller asked for
+        // and the bridge validates it server-side, which is what lets an
+        // illegal name be refused with a message rather than failing to
+        // deserialise. Only the ROSTER ENTRY is an `Ident`, because that one
+        // describes something the store already accepted.
         let req = BridgeRequest::EnsureAgentIdentity {
             name: "atlas".to_owned(),
         };
@@ -180,7 +200,7 @@ mod tests {
     #[test]
     fn a_roster_entry_carries_only_the_name() {
         let entry = serde_json::to_value(AgentIdentity {
-            name: "atlas".to_owned(),
+            name: Ident::parse("atlas").expect("valid ident"),
         })
         .unwrap();
         let keys: Vec<&String> = entry.as_object().expect("an object").keys().collect();