matrix: name the credential after the account it authenticates as

The store path and every identifier around it called this an admin
token. It is not one: of ~15 hive-c0re call sites only two need
homeserver admin, and the homeserver no longer promotes the account at
boot, so the name overstated both what the credential is and what it may
do.

Renaming it to the account was not enough either. "The `@hive:` token"
reads as the token of a hive user, and no such user is provisioned —
`@hive:<server_name>` is the appservice registration's own
`sender_localpart`, an account the homeserver creates for itself when it
loads the registration.

So it is the **sender token**: the matrix appservice sender account's
access token, at `swarm/services/matrix/sender-token`. The name says
what it authenticates as rather than what it may do, which is the part
that was wrong.

The path has one constructor, and the bao grant, the grant assertion and
three unit tests pin its literal independently — so a half-finished
rename fails a check rather than leaving the minter and its readers
disagreeing at runtime. `tracing` messages are renamed with the code, so
the journal reads the way the source does.

The host-side file keeps its name (`matrix/access-token`): it carried no
admin framing, and renaming it would orphan the file on every deployed
hive for nothing.

`docs/tools/hivectl-cli.md` is regenerated from the clap tree.

nix/host-modules/hive-matrix.nix

@@ -115,7 +115,7 @@ let
 
   # ── swarm-matrix-minter ────────────────────────────────────────────────
   #
-  # The oneshot that publishes the `@hive:` account's access token to
+  # The oneshot that publishes the appservice sender account's access token to
   # the swarm's secret store. It runs INSIDE the container, beside tuwunel,
   # because the appservice token that authorises the mint is already in here —
   # `appserviceDir` below is bound read-only precisely so the homeserver can
@@ -1392,7 +1392,7 @@ in
             "oidc_client_secret:${toString deployCfg.matrix.sso.clientSecretFile}"
           ];
 
-          # Publish the `@hive:` account's access token to the swarm
+          # Publish the appservice sender account's access token to the swarm
           # store, once, under an identity that belongs to this container and
           # not to the hive. See `minterActive` above for why it runs here.
           #
@@ -1403,7 +1403,7 @@ in
           # set, because the unit having succeeded is not the idempotency
           # record — the store is, and it outlives this machine.
           systemd.services.swarm-matrix-minter = lib.mkIf minterActive {
-            description = "publish the @hive: matrix credential to the swarm secret store";
+            description = "publish the matrix sender token to the swarm secret store";
             # Ordered after the homeserver because both of the ladder's arms
             # are client-server API calls. `wants`, not `requires`: a run that
             # finds the credential already published never touches tuwunel at

nix/host-modules/swarm-bao.nix

@@ -249,7 +249,7 @@ let
   # written by the caller — the same trap as the two grants above.
   #
   # Not `swarm/services/*` like the publisher's: this principal produces
-  # exactly one secret, the `@hive:` account's access token, and a
+  # exactly one secret, the appservice sender account's access token, and a
   # homeserver is not entitled to overwrite Grafana's OIDC client. The path is
   # spelled to the leaf for that reason, not for tidiness.
   #
@@ -260,7 +260,7 @@ let
   # here recovers one secret this principal itself wrote, which is a much
   # narrower grant than the publisher's would have been.
   matrixMinterPolicyText = ''
-    path "${credentialMountPath}/data/swarm/services/matrix/hive-access-token" {
+    path "${credentialMountPath}/data/swarm/services/matrix/sender-token" {
       capabilities = ["create", "update", "read"]
     }
   '';
@@ -695,7 +695,7 @@ in
       description = ''
         Subject the store's matrix-minter cert-auth role accepts — the
         identity the oneshot inside the matrix container presents when it
-        publishes the `@hive:` account's access token.
+        publishes the appservice sender account's access token.
 
         A **third** identity rather than reuse of either sibling above, and
         the narrowest of the three: its grant is one path, that