matrix: name the credential after the account it authenticates as

The store path and every identifier around it called this an admin
token. It is not one: of ~15 hive-c0re call sites only two need
homeserver admin, and the homeserver no longer promotes the account at
boot, so the name overstated both what the credential is and what it may
do.

Renaming it to the account was not enough either. "The `@hive:` token"
reads as the token of a hive user, and no such user is provisioned —
`@hive:<server_name>` is the appservice registration's own
`sender_localpart`, an account the homeserver creates for itself when it
loads the registration.

So it is the **sender token**: the matrix appservice sender account's
access token, at `swarm/services/matrix/sender-token`. The name says
what it authenticates as rather than what it may do, which is the part
that was wrong.

The path has one constructor, and the bao grant, the grant assertion and
three unit tests pin its literal independently — so a half-finished
rename fails a check rather than leaving the minter and its readers
disagreeing at runtime. `tracing` messages are renamed with the code, so
the journal reads the way the source does.

The host-side file keeps its name (`matrix/access-token`): it carried no
admin framing, and renaming it would orphan the file on every deployed
hive for nothing.

`docs/tools/hivectl-cli.md` is regenerated from the clap tree.

docs/integrations/matrix.md

@@ -147,7 +147,7 @@ a token.
    (`hive-matrix-daemon.path` watching for `matrix-token` appearance)
    brings the daemon up on the same boot cycle anyway.
 
-### The `@hive:` account, and why it isn't an admin
+### The appservice's sender account, and why it isn't an admin
 
 `@hive:<server_name>` is the appservice's own `sender_localpart`, which
 the homeserver creates itself when it loads the registration — on a
@@ -155,6 +155,14 @@ zero-user database, inside startup, before the HTTP listener accepts
 anything. It's an **ordinary account**: nothing promotes it, and the
 homeserver runs no `admin_execute` for it.
 
+Its access token is the **sender token**, and it's the credential
+hive-c0re presents for every homeserver call it makes on the hive's
+behalf. `swarm-matrix-minter` mints it inside the `hive-matrix`
+container and publishes it to `swarm/services/matrix/sender-token`; the
+hive reads it from there. The name says what it authenticates as — an
+account the appservice registration brings into being — rather than any
+privilege level, because it carries none.
+
 It needs no promotion for what the hive does with it. Creating the hive
 Space and the chat room, writing their hierarchy and join rules, and
 inviting agents into them are all ordinary client calls that ride on
@@ -187,7 +195,7 @@ restarts, so the first boot after the switch already has both halves.
 - **The per-agent sweep honours existing token files.** It skips any
   agent that already has a `matrix-token`, so it re-registers no account
   and displaces no session.
-- **`@hive:` may already be an admin** on such a hive (it won the
+- **The sender account may already be an admin** on such a hive (it won the
   first-user grant when the hive was new). Nothing here demotes it; the
   homeserver no longer promotes it, so a hive built fresh has an
   ordinary account and an older one keeps whatever standing it acquired.