swarm-secret-client: one module per kind of secret, not one struct

mara, reviewing the previous commit: "the field is specific to matrix, why
add it to the general struct". She is right, and the answer is that there was
no general struct — `Credential` had one consumer, the crate's only path
builder was `matrix_account`, and `value` is pinned by
`glue-matrix-bao-token.nix`, a matrix unit. It was matrix's throughout,
wearing a general name; adding `homeserver` is what made that visible.

`client` now moves whatever type a caller names and decodes nothing itself.
That is forwarding rather than machinery: `vaultrs::kv2::read`/`set` are
already generic over the payload.

The matrix agreement moves to its own module holding both halves — where a
credential lives (`account_path`, was `path::matrix_account`) and what the
object at that path holds. `path` keeps only what every path obeys, so a
second kind of swarm secret becomes a module beside `matrix` rather than
another optional field on a struct it shares. argus raised the same collision
from the other direction on #4092: two mutually-exclusive `Option`s modelling
one concept is the failure mode this forecloses.

`checked_segment` stays public in `path`: hive-priv builds an on-disk path
from the same names and must accept the same charset.

Behaviour is unchanged. The compatibility properties move with the struct —
`Option` is what lets a pre-`homeserver` stored object decode, and
`skip_serializing_if` is what keeps a token-only object free of
`"homeserver":null` for that nix reader.

Refs #3726

swarm-secret-client/src/lib.rs

@@ -2,12 +2,18 @@
 //! reach it.
 //!
 //! The HTTP is [`vaultrs`]'s job. What this crate owns is the *agreements* —
-//! the path a credential is written to and read from ([`path`]), the field its
-//! bytes live in, and the translation from this deployment's environment into
-//! a logged-in client ([`client`]). Each of those is a thing the controller and
-//! a hive must say identically, so it is said once here.
+//! the rules every path obeys ([`path`]), the translation from this
+//! deployment's environment into a logged-in client ([`client`]), and, per kind
+//! of secret, the path it lives at together with the fields it holds
+//! ([`matrix`]). Each of those is a thing the controller and a hive must say
+//! identically, so it is said once here.
+//!
+//! [`client`] is deliberately ignorant of all of it: it moves whatever type a
+//! caller names, so a second kind of secret is a new module beside [`matrix`]
+//! and not another field on a struct shared with it.
 
 pub mod client;
+pub mod matrix;
 pub mod path;
 
 pub use client::SecretStore;