identity: a consumer's identity fits the tightest backend, via a slug (ADR 0054)

A module may declare a short `slug`; the mesh derives mesh_<node>_<slug|name> and
refuses at assignment (naming the slug as the remedy) when it would still overflow —
identityLimit is now 20, an S3 access key's, the tightest of the backends a login
reaches (04-ISSUES/010). The slug rides the grant so the provider derives the same
login the consumer does, even across nodes. CheckIdentity is now wired, in grantsFor.

Also, the minted secret shrinks to 40 chars (30 bytes) from 43: an S3 secret key is
8-40, the same fit-the-tightest-backend rule on the credential's other half.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

internal/catalogue/manifest.go

@@ -119,6 +119,13 @@ type Manifest struct {
 	Module  string `json:"module"`
 	Version string `json:"version,omitempty"`
 
+	// Slug is a short identifier the mesh uses in place of the module name when it derives a
+	// consumer's login (novox/hq ADR 0054). Optional: a module with a short name needs none. It
+	// exists because `mesh_<node>_<module>` must fit the tightest backend a consumer reaches — an S3
+	// access key is 20 characters — and a long module name would overflow it. A person choosing
+	// `kc` for keycloak keeps the identity legible where a hash would not.
+	Slug string `json:"slug,omitempty"`
+
 	// Provides are the names other modules may require. A module always provides its own name;
 	// this is for the rest — `zsh` provides `shell`, `xorg` provides `display-server`.
 	Provides []Offer `json:"provides,omitempty"`
@@ -467,6 +474,13 @@ func ParseManifest(raw []byte) (Manifest, error) {
 		problems = append(problems, fmt.Sprintf(
 			"%q is not a usable module name: lower-case letters, digits, dashes and dots", m.Module))
 	}
+	// A slug is a short identifier the mesh derives a login from (novox/hq ADR 0054). The same
+	// charset as a name; its length is checked against a backend's limit at assignment, where the
+	// node it joins is known — a slug that is fine on one machine's short name can overflow another's.
+	if m.Slug != "" && !name.MatchString(m.Slug) {
+		problems = append(problems, fmt.Sprintf(
+			"%q is not a usable slug: lower-case letters, digits, dashes and dots", m.Slug))
+	}
 	for _, offer := range m.Provides {
 		p := offer.Name
 		if !name.MatchString(p) {