swarm-controller reads its forge token from the store, not a host file

The controller's forge token never entered bao: the forge minted it in its
container, hive-forge-swarm-controller-token copied it to a host file, and the
controller LoadCredential'ed that file. forgeTokenFile defaulted to that path
only where the forge ran, so a controller on any other host had no forge
access unless an operator copied the file by hand.

Now the forge's host publishes it and the controller reads it:

- swarm-bao-forge-publisher (replaces hive-forge-swarm-controller-token)
  waits for the in-container token, logs in with its own forge-publisher leaf
  and writes it to swarm/controller/swarm-controller/forge/token. It runs on
  every forge container start, the old unit's trigger.
- New principal swarm-forge-publisher: leaf minted by glue-bao-tls.nix,
  policy create/update on that one path, written by
  swarm-bao-forge-publisher-policy, CN reserved as a hive name.
- The controller policy gains read on that path. swarm-controller reads it
  at start under its own certificate with the OIDC secret's retry, and runs
  without forge access if it still cannot.
- forgeTokenFile, its LoadCredential and the forgeEnv gate are gone;
  SWARM_CONTROLLER_FORGE_URL is always set. hostSwarmControllerTokenFile is
  removed, and a tmpfiles rule deletes the old host copy on the forge host.

The in-container file stays: the mint unit's only-once guard reads it, and
it is the publisher's source.

Refs #4998

nix/host-modules/deploy.nix

@@ -70,10 +70,12 @@ in
       [ "services" "hyperhive" "swarm" "controller" "enable" ]
       [ "services" "hyperhive" "deploy" "swarm-controller" "enable" ]
     )
-    (lib.mkRenamedOptionModule
-      [ "services" "hyperhive" "swarm" "controller" "forgeTokenFile" ]
-      [ "services" "hyperhive" "deploy" "swarm-controller" "forgeTokenFile" ]
-    )
+    (lib.mkRemovedOptionModule [ "services" "hyperhive" "swarm" "controller" "forgeTokenFile" ] ''
+      The controller reads its forge token from the swarm's secret store, under
+      its own certificate, and swarm-bao-forge-publisher on the forge's host
+      puts it there. Remove this definition; the file it named is read by
+      nothing now and can be deleted.
+    '')
     (lib.mkRenamedOptionModule
       [ "services" "hyperhive" "swarm" "controller" "authBridgeUrl" ]
       [ "services" "hyperhive" "deploy" "swarm-controller" "authBridgeUrl" ]
@@ -231,9 +233,13 @@ in
       [ "services" "hyperhive" "swarm" "forge" "sso" "clientSecretFile" ]
       [ "services" "hyperhive" "deploy" "forgejo" "sso" "clientSecretFile" ]
     )
-    (lib.mkRenamedOptionModule
-      [ "services" "hyperhive" "swarm" "forge" "hostSwarmControllerTokenFile" ]
-      [ "services" "hyperhive" "deploy" "forgejo" "hostSwarmControllerTokenFile" ]
+    (lib.mkRemovedOptionModule [ "services" "hyperhive" "swarm" "forge" "hostSwarmControllerTokenFile" ]
+      ''
+        The forge publishes the swarm-controller's forge token to the swarm
+        secret store (swarm-bao-forge-publisher), and the controller reads it
+        there. Remove this definition; the file it named is read by nothing now
+        and can be deleted.
+      ''
     )
 
     # The homeserver, split the same way. `swarm.matrix` keeps what it IS to