#2195 access token mint: support --server so worker server tokens can be minted remotely

Summary

swamp access token mint has no --server support, unlike worker token create and the other commands given --server in #711 and f9166b30. Minting a server token for a non-human principal (e.g. a Kubernetes worker's --server-token-file, or a rotation job) therefore requires running the CLI inside the serve pod against its repo, and the plaintext is not in --json output — it has to be fetched afterwards with swamp access token reveal.

For unattended Kubernetes worker setups this is the one step that still needs an exec into the serve pod.

Observed on 20260911.215321 (d18f2d86); src/cli/commands/access_token_mint.ts is still not wrapped in withRemoteOptions at 34d98319.

Proposal

• Add --server / --server-token-file to swamp access token mint (and rotate), backed by a serve protocol message authorized as admin on access:*, reusing serverTokenCreate in libswamp.
• Keep the secure vault handoff semantics from #2128 over the remote path.
• Update the access-commands reference and the worker-fleets Kubernetes guide to show minting a no-grant server token for workers remotely.

Affected components: access_token_mint.ts CLI command, serve protocol (src/serve/protocol.ts), admin handlers, docs.