#2401 Docs: --principal valid kinds for access token mint, and the invalid-principal 401 reason

Follow-up to swamp-club#2383 (fix: swamp-club/swamp#2570).

What changed

• swamp access token mint --principal now accepts only user:<id> and worker:<id>. Any other kind (for example agent:x), a value with no colon, or an empty id is rejected at mint time. This applies to local mints and to mints through swamp serve.
• In token auth mode, serve now rejects a stored token whose principal does not parse with 401 Unauthorized: invalid-principal. Before, the connection crashed with a 500.
• When a server returns a 5xx on connect, the CLI now reports Server error (HTTP N) ... check the server log. It no longer says "Authentication failed".

Pages to update

• content/manual/reference/swamp-serve/access-commands.md, the swamp access token mint flags table: the --principal row says "Principal identity (e.g., user:adam)". It should say the valid forms are user:<id> or worker:<id>, and that other kinds are rejected.
• content/manual/reference/swamp-serve/authorization.md (or wherever token authentication failures are listed): add invalid-principal next to the existing 401 rejection reasons (expired, revoked, secret-mismatch, ...). Say that it means the token was minted for an unsupported principal kind, and that the fix is swamp access token revoke and then re-mint. swamp auth server-login won't fix it.

Suggested content

--principal — Required. The identity the token authenticates as: user:<id> or worker:<id>. Other principal kinds are rejected.