derive a missing client digest from the secret that exists

A client with a secret in the store or in a leftover file but no digest gets the digest of that secret instead of stopping the unit. The password reaches authelia's prompt through a pty, not argv. A lost mint race takes the winner's secret. Also name the mint, not the publisher, in the remaining rust docs.

nix/host-modules/swarm-authelia.nix

@@ -522,9 +522,8 @@ let
   # The plaintext goes straight into the store and only the digest is written
   # to disk. A digest on disk is enough for authelia to start while the store is
   # down; a client with no digest cannot be rendered, so that run fails and
-  # retries (./lib/store-retry.nix). A status of 3 is a state a retry does not
-  # change, and `RestartPreventExitStatus` leaves the unit failed for an
-  # operator.
+  # retries (./lib/store-retry.nix). A client whose digest is missing gets it
+  # from the secret that exists, so nothing is minted again.
   storeMintScript = ''
     ${oidcClientSecrets}
     ${lib.concatMapStrings (c: ''
@@ -1246,6 +1245,7 @@ in
               deployCfg.bao.package
               pkgs.gnugrep
               pkgs.systemd
+              pkgs.util-linux
             ];
             # A store that cannot answer, with a key missing on disk, is a
             # failed run that retries (./lib/store-retry.nix).
@@ -1266,9 +1266,6 @@ in
               // {
                 LoadCredential = lib.attrNames storeFiles;
                 TimeoutStartSec = 120;
-                # A secret that has no digest, or a digest that has no secret,
-                # is for an operator; minting again would rotate it.
-                RestartPreventExitStatus = 3;
               }
             );
             environment = lib.optionalAttrs publishes (