swarm-secret-client: one module per kind of secret, not one struct

mara, reviewing the previous commit: "the field is specific to matrix, why
add it to the general struct". She is right, and the answer is that there was
no general struct — `Credential` had one consumer, the crate's only path
builder was `matrix_account`, and `value` is pinned by
`glue-matrix-bao-token.nix`, a matrix unit. It was matrix's throughout,
wearing a general name; adding `homeserver` is what made that visible.

`client` now moves whatever type a caller names and decodes nothing itself.
That is forwarding rather than machinery: `vaultrs::kv2::read`/`set` are
already generic over the payload.

The matrix agreement moves to its own module holding both halves — where a
credential lives (`account_path`, was `path::matrix_account`) and what the
object at that path holds. `path` keeps only what every path obeys, so a
second kind of swarm secret becomes a module beside `matrix` rather than
another optional field on a struct it shares. argus raised the same collision
from the other direction on #4092: two mutually-exclusive `Option`s modelling
one concept is the failure mode this forecloses.

`checked_segment` stays public in `path`: hive-priv builds an on-disk path
from the same names and must accept the same charset.

Behaviour is unchanged. The compatibility properties move with the struct —
`Option` is what lets a pre-`homeserver` stored object decode, and
`skip_serializing_if` is what keeps a token-only object free of
`"homeserver":null` for that nix reader.

Refs #3726

swarm-secret-client/README.md

@@ -61,12 +61,23 @@ read an error about, and none of them needs a reachable store to happen.
 
 ## Names that arrive from elsewhere
 
-`path::matrix_account` is fallible, which for a string formatter needs saying:
+`matrix::account_path` is fallible, which for a string formatter needs saying:
 its segments are an agent name from the topology and an account name from that
 agent's own config. A `/` turns one agent's segment into another agent's
 directory and `..` walks out of the prefix entirely, so the charset it accepts
 is deliberately narrower than what the store would.
 
+## One module per kind of secret
+
+`client` moves whatever type a caller names; it decodes nothing itself. What a
+stored object _holds_ is stated in the module that also builds its path —
+`matrix` today, and a second kind of swarm secret gets a module beside it.
+
+The split is deliberate. A single shared struct that grows one field per
+consumer ends up carrying, on every path, a field only one path's reader has
+ever heard of; and the two things a kind of secret must pin — where it lives
+and what is in it — are one agreement that reads worse split across modules.
+
 ## What this crate does not do
 
 It has no opinion on **what** a caller may read. That is the policy attached to