swarmctl: add bao init and bao grant-bootstrap

init prints the store's keys and root token once and keeps none; with
--and-grant it goes on to the granter bootstrap in the same process.
grant-bootstrap does that step alone, reading the root token from a
hidden prompt or stdin. The token reaches bao only as BAO_TOKEN in the
child's environment.

nix/host-modules/glue-controller-env.nix

@@ -47,6 +47,15 @@ in
           SWARMCTL_AUTHELIA_USERS_FILE = deployCfg.authelia.hostUsersFile;
         };
       })
+      # The same wrapper, gated on the store running HERE: `bao grant-bootstrap`
+      # places a token and restarts a unit that exist only on that host.
+      (lib.mkIf (deployCfg.bao.enable && deployCfg.bao.bootstrapTokenFile != null) {
+        services.hyperhive.deploy.swarm-controller.swarmctlEnvironment = {
+          SWARMCTL_BAO_BOOTSTRAP_TOKEN_FILE = deployCfg.bao.bootstrapTokenFile;
+          SWARMCTL_BAO_BOOTSTRAP_POLICY = "${config.environment.etc."hyperhive/bao-bootstrap-policy.hcl".source
+          }";
+        };
+      })
       {
         systemd.services.swarm-controller.environment = {
           OTEL_EXPORTER_OTLP_ENDPOINT = "https://${otelSwarmCfg.domain}/${otelSwarmCfg.producerName}";