swarm-archive: external s3 backend (options, prune path, docs, module-eval cases, vm fake s3)

- swarm-archive.nix, lib/archive-server.nix: deploy.archive.backend and
  deploy.archive.s3.* options; the s3 server and the prune read the key from the
  store into rclone's environment; the prune lists and addresses repositories
  through rclone instead of a local directory
- swarm-bao.nix: the archive reads swarm/services/archive/s3/*
- docs: archive.md "External S3" section, two credentials-reference rows
- module-eval: builder.nix cases for local and s3, the missing-setting
  assertion; bao-grants.nix gains the s3 read grant
- vm test: second node with a fake rclone serve s3 whose key is generated at
  test time

nix/host-modules/swarm-bao.nix

@@ -1394,7 +1394,8 @@ let
   # The backup archive: the users file is rendered from one leaf per agent, and
   # the prune reads each agent's restic password. Read and list only; the
   # controller writes both. It also creates the marker that tells the
-  # controller an archive exists.
+  # controller an archive exists. With an external S3 backend it reads the
+  # provider key, which the operator writes.
   archiveReaders = [
     {
       name = "swarm-archive";
@@ -1402,6 +1403,7 @@ let
       policyText =
         readStanza "${credentialMountPath}/data/swarm/services/archive/users/*"
         + readStanza "${credentialMountPath}/data/swarm/services/archive/restic/*"
+        + readStanza "${credentialMountPath}/data/swarm/services/archive/s3/*"
         + listStanza "${credentialMountPath}/metadata/swarm/services/archive/users/"
         + createReadStanza "${credentialMountPath}/data/swarm/services/archive/ready";
     }
@@ -2685,7 +2687,7 @@ in
       description = ''
         Subject the store's `swarm-archive` cert-auth role accepts: the identity
         the backup archive's host units present. Its grant is read on
-        `swarm/services/archive/users/*` and `restic/*`, and list on `users`.
+        `swarm/services/archive/users/*`, `restic/*` and `s3/*`, and list on `users`.
 
         ⚠️ Reserved as a hive name by ./swarm.nix, like its siblings.
       '';