matrix: name the credential after the account it authenticates as

The store path and every identifier around it called this an admin
token. It is not one: of ~15 hive-c0re call sites only two need
homeserver admin, and the homeserver no longer promotes the account at
boot, so the name overstated both what the credential is and what it may
do.

Renaming it to the account was not enough either. "The `@hive:` token"
reads as the token of a hive user, and no such user is provisioned —
`@hive:<server_name>` is the appservice registration's own
`sender_localpart`, an account the homeserver creates for itself when it
loads the registration.

So it is the **sender token**: the matrix appservice sender account's
access token, at `swarm/services/matrix/sender-token`. The name says
what it authenticates as rather than what it may do, which is the part
that was wrong.

The path has one constructor, and the bao grant, the grant assertion and
three unit tests pin its literal independently — so a half-finished
rename fails a check rather than leaving the minter and its readers
disagreeing at runtime. `tracing` messages are renamed with the code, so
the journal reads the way the source does.

The host-side file keeps its name (`matrix/access-token`): it carried no
admin framing, and renaming it would orphan the file on every deployed
hive for nothing.

`docs/tools/hivectl-cli.md` is regenerated from the clap tree.

hivectl/src/cli.rs

@@ -335,7 +335,7 @@ pub enum MatrixCmd {
         #[arg(long, conflicts_with = "password")]
         password_stdin: bool,
     },
-    /// Provision (or re-provision) the hive's own `@hive:` matrix account.
+    /// Provision (or re-provision) the matrix appservice's sender account.
     ///
     /// Runs automatically on startup; run manually to recover a missing
     /// access token.

hivectl/src/matrix.rs

@@ -1,5 +1,5 @@
 //! `hivectl matrix` — matrix account provisioning verbs. hivectl forwards
-//! each request to the daemon (which owns the register + `@hive:` tokens and
+//! each request to the daemon (which owns the register + sender tokens and
 //! the matrix creds dir) and renders the reply; it no longer links the
 //! matrix machinery itself.
 
@@ -28,7 +28,7 @@ pub(crate) async fn run_matrix_cmd(socket: &Path, cmd: MatrixCmd) -> Result<()>
 
 /// Send a matrix provisioning request to the daemon and print the
 /// operator-facing result lines it returns. The daemon owns the register +
-/// `@hive:` tokens and the matrix creds dir, so hivectl no longer links the
+/// sender tokens and the matrix creds dir, so hivectl no longer links the
 /// matrix machinery — it just forwards the request and renders the reply.
 async fn matrix_request(socket: &Path, req: hive_host_sock::HostRequest) -> Result<()> {
     let resp = crate::client::request(socket, req)