swarm-archive: external s3 backend (options, prune path, docs, module-eval cases, vm fake s3)

- swarm-archive.nix, lib/archive-server.nix: deploy.archive.backend and
  deploy.archive.s3.* options; the s3 server and the prune read the key from the
  store into rclone's environment; the prune lists and addresses repositories
  through rclone instead of a local directory
- swarm-bao.nix: the archive reads swarm/services/archive/s3/*
- docs: archive.md "External S3" section, two credentials-reference rows
- module-eval: builder.nix cases for local and s3, the missing-setting
  assertion; bao-grants.nix gains the s3 read grant
- vm test: second node with a fake rclone serve s3 whose key is generated at
  test time

nix/module-eval/bao-grants.nix

@@ -2201,6 +2201,9 @@ let
         in
         (grantFor grants "secret/data/swarm/services/archive/users/atlas").caps == [ "read" ]
         && (grantFor grants "secret/data/swarm/services/archive/restic/atlas").caps == [ "read" ]
+        && (grantFor grants "secret/data/swarm/services/archive/s3/access-key-id").caps == [ "read" ]
+        && (grantFor grants "secret/data/swarm/services/archive/s3/secret-access-key").caps == [ "read" ]
+        && grantFor c "secret/data/swarm/services/archive/s3/access-key-id" == null
         && (grantFor grants "secret/metadata/swarm/services/archive/users/").caps == [ "list" ]
         &&
           (grantFor grants "secret/data/swarm/services/archive/ready").caps == [
@@ -2209,7 +2212,7 @@ let
           ]
         && (grantFor c "secret/data/swarm/services/archive/ready").caps == [ "read" ]
         && grantFor grants "secret/data/swarm/hives/h1/archive/atlas" == null
-        && lib.length grants == 4
+        && lib.length grants == 5
         && lib.hasInfix "allowed_common_names=swarm-archive" s
         && lib.hasInfix "token_policies=swarm-archive" s
         && lib.elem "create" (grantFor c "secret/data/swarm/services/archive/users/atlas").caps