refactor(swarm-queue-client): a library's errors are an enum, not anyhow

Operator ruling: libs should not use anyhow. The queue connect was moved
here verbatim from swarm-controller, which is a binary, so it arrived
still wearing a binary's error handling — the move changed what the code
is without changing how it reports.

Callers get variants they can match on, split by what an operator does
about them: a half-configured environment is a deployment bug, a refused
token is an identity-provider config problem, an unreachable queue is a
network one. The binaries that consume this keep anyhow and `?` converts,
so nothing downstream is more verbose for it. Same split hive-claude uses.

One thing anyhow was doing unpaid: the auth callback hands async-nats a
plain string, and a Display that stops at the top message drops the cause
— the half that says why the mint failed. `chain()` walks the source
chain, which is what `{:#}` was doing before.

swarm-queue-client/Cargo.toml

@@ -5,7 +5,6 @@ readme = "README.md"
 edition.workspace = true
 
 [dependencies]
-anyhow.workspace = true
 # No `kv`/`jetstream` feature here on purpose: this crate's job ends at a
 # connected client. What a consumer does with it - KV for the controller and
 # the hive, plain messaging for anything later - is the consumer's business,
@@ -14,6 +13,9 @@ async-nats.workspace = true
 reqwest.workspace = true
 serde.workspace = true
 serde_json.workspace = true
+# A library, so its errors are a matchable enum rather than an opaque
+# `anyhow::Error`. The binaries that consume this keep anyhow; `?` converts.
+thiserror.workspace = true
 tokio.workspace = true
 tracing.workspace = true