docs: the credentials page keeps the approach and moves the mechanics out

credentials.md drops the target-shape framing and keeps the rules, where a
secret lives, the swarm- and hive-level secrets and how to add one. The queue
responder's keys, per-principal identities, how a reader reaches the store, the
store UI's login and where the root lives move to
4-implementation/swarm/credentials.md. The per-secret reference moves to
4-implementation/swarm/credentials-reference.md. Links and comments follow.

docs/2-handbook/swarm/README.md

@@ -52,7 +52,7 @@ grafana, the controller, authelia, …) →
   → [`sso.md`](sso.md)
 - **secrets** — the rules a credential follows → [`credentials.md`](credentials.md);
   every credential the swarm holds, who mints it, who reads it, how it renews
-  and where it lives → [`credentials-reference.md`](credentials-reference.md) ·
+  and where it lives → [`credentials-reference.md`](../../4-implementation/swarm/credentials-reference.md) ·
   how the store comes up, who writes its grants and how it unseals →
   [`bao.md`](../../4-implementation/swarm/bao.md)
 - **swarm CA** — the store root every hive's gateway leaf chains to, and what to