render the matrix appservice registration from the store onto tmpfs

swarm-matrix-ctl appservice render now reads the registration's tokens
from the store and renders swarm.yaml under /run/swarm-matrix-appservice,
which tuwunel loads through LoadCredential. It mints a pair only when the
store answers and holds none; a host that has the old files stores their
pair once instead. A store that does not answer fails the unit and keeps
tuwunel down; sync starts it once the store answers.

Refs #4998 (item 3)

swarm-matrix-ctl/src/main.rs

@@ -7,8 +7,8 @@
 //! identity plumbing to add one action, so the next thing that has to run in
 //! here is a verb below, not a new crate.
 //!
-//! [`appservice`] mints the **swarm's** own appservice registration and
-//! keeps it in step with the store and publishes its token for `swarm-controller`.
+//! [`appservice`] renders the **swarm's** own appservice registration from
+//! the store and publishes its token for `swarm-controller`.
 //!
 //! 🩸 **A secret is a path, never a value.** The only identifier any verb here
 //! logs is the store path; see `swarm_matrix_client`'s module doc for the same rule
@@ -39,12 +39,13 @@ enum Command {
 
 #[derive(Debug, Subcommand)]
 enum Appservice {
-    /// Mint the tokens when absent and render the registration tuwunel loads.
-    /// Local only: it runs before the homeserver and must not need a network.
+    /// Render the registration tuwunel loads from the store, minting the tokens
+    /// first when the store holds none. Runs before the homeserver, which stays
+    /// down until the store answers.
     Render,
-    /// Make the state dir hold the store's registration, seeding the store
-    /// from it when the store holds none, and restart the homeserver when the
-    /// registration is newer than its last start. Runs beside the homeserver, never before it.
+    /// Make the rendered registration match the store's, restart the homeserver
+    /// when the registration is newer than its last start, and publish the
+    /// `as_token` for `swarm-controller`. Runs beside the homeserver.
     Sync,
 }
 
@@ -58,7 +59,7 @@ async fn main() -> Result<()> {
         .init();
 
     match Cli::parse().command {
-        Command::Appservice(Appservice::Render) => appservice::render(),
+        Command::Appservice(Appservice::Render) => appservice::render().await,
         Command::Appservice(Appservice::Sync) => appservice::sync().await,
     }
 }