move stored_secret from swarm-queue-client to swarm-secret-client

The module is a rename (97% similar); everything else in the diff follows
from the move:

- stored_secret.rs: private `chain()` helper, the 8-line copy of the queue
  crate's `chain` the module called as `crate::chain`; the queue crate's
  public `chain` stays.
- stored_secret.rs: `Duration::from_mins(5)` in `MAX_REREAD_DELAY` is
  unchanged moved code, not a new use.
- swarm-secret-client Cargo.toml: gains futures-util, tokio and tracing as
  dependencies and tokio `test-util` plus tracing-subscriber as dev
  dependencies; the module and its tests use them.
- swarm-queue-client Cargo.toml: drops futures-util and the tracing-subscriber
  dev dependency, which only the moved module used; its tokio dev comment is
  reworded to the tests that remain.
- Cargo.lock: the same dependency moves, nothing else.
- swarm-queue-client lib.rs: imports `swarm_secret_client::stored_secret`,
  and its tests use a small local `Store` in place of the moved module's
  test-only `Fake`, which is no longer reachable.
- callers (hive-c0re, swarm-builder, swarm-ci-metrics, swarm-claude-login,
  swarm-controller, swarm-nats-auth, swarm-review-classifier): import path
  only; no re-export is left behind.

swarm-queue-client/Cargo.toml

@@ -68,9 +68,6 @@ agent-archetype = ["async-nats/jetstream"]
 # above - the connect itself needs none of them.
 async-nats.workspace = true
 backon.workspace = true
-# `Shared`, so every caller refused while a secret re-read runs waits on that
-# one read (`stored_secret`).
-futures-util.workspace = true
 hive-sh4re = { workspace = true, optional = true }
 # `blocking` on top of the workspace default (`form`/`json`/`rustls`) —
 # `mint_token_for_blocking` needs `reqwest::blocking::Client` for a caller
@@ -85,7 +82,8 @@ reqwest = { workspace = true, features = ["blocking"] }
 serde.workspace = true
 serde_json.workspace = true
 strum.workspace = true
-# The rustls provider `connect` installs.
+# `stored_secret::StoredSecret`, the held client secret, and the rustls
+# provider `connect` installs.
 swarm-secret-client.workspace = true
 # A library, so its errors are a matchable enum rather than an opaque
 # `anyhow::Error`. The binaries that consume this keep anyhow; `?` converts.
@@ -98,12 +96,9 @@ utoipa = { workspace = true, optional = true }
 # A loopback stand-in token endpoint for the client secret re-read tests.
 axum.workspace = true
 data-encoding.workspace = true
-# `test-util` for `#[tokio::test(start_paused = true)]`: the re-read backoff
-# tests run on paused time.
+# `test-util` for `#[tokio::test(start_paused = true)]`: the startup-read
+# retry tests run on paused time.
 tokio = { workspace = true, features = ["test-util"] }
-# Capturing what a re-read logs, to check it names the client and never the
-# secret.
-tracing-subscriber.workspace = true
 
 [lints]
 workspace = true