swarm-nats, matrix: the queue's and matrix-ctl's store identity paths are their own, not the hive's

glue-nats-bao-identity.nix and glue-matrix-ctl-bao-identity.nix defaulted
deploy.nats.baoClient{Cert,Key}File and deploy.matrix.ctlBaoClient{Cert,Key}File
to siblings of deploy.bao.clientCertFile, the hive's own store reader. That
pointed a store host whose reader was moved at files nobody mints, and on a
queue or homeserver host without the store that held a placed hive reader
invented a nats.pem / matrix-ctl.pem path beside it.

Both glues are now gated on the store running on this host
(deploy.bao.enable, the condition glue-bao-tls.nix mints under) and name the
directory the minting unit writes to, through nix/host-modules/lib/bao-pki-dir.nix.

Host shapes:
- Store host, default reader: unchanged. The evaluated paths stay
  /var/lib/swarm-bao-pki/nats{,-key}.pem and
  /var/lib/swarm-bao-pki/matrix-ctl{,-key}.pem, and the rendered units are
  the same.
- Store host whose hive reader was moved: now gets the leaf minted there.
- Queue or homeserver host without the store, holding a hive reader and not
  naming these options: no default any more. It still evaluates (neither
  option has an eval assertion). swarm-bao-nats-tls exits 1 naming
  deploy.nats.baoClient{Cert,Key}File when the queue's certificate is missing
  or due for renewal; swarm-bao-matrix-oidc exits 1 naming
  ctlBaoClient{Cert,Key}File, and the swarm appservice render/publish units
  and the PKI bind mount no longer render. If that host had placed nats.pem
  or matrix-ctl.pem beside its hive reader, it worked before and now needs
  both options named.
- Hosts without the store and without a hive reader, and hosts naming the
  options: unchanged.

Both refusals and option descriptions now say the default comes from
deploy.bao.enable.

Refs #4921

nix/module-eval/nats-tls.nix

@@ -46,6 +46,24 @@ let
     deploy.nats.autoGenerateCallout = true;
   };
 
+  # The store's host with the hive's own reader pointed somewhere else.
+  natsOnStoreHostReaderMoved = hive {
+    deploy.bao.enable = true;
+    deploy.nats.enable = true;
+    deploy.nats.autoGenerateCallout = true;
+    deploy.bao.clientCertFile = "/etc/pki/h1.pem";
+    deploy.bao.clientKeyFile = "/etc/pki/h1-key.pem";
+  };
+
+  # A queue host holding only the hive's own store reader, placed by hand: no
+  # store here, and no queue leaf named.
+  queueWithHiveReaderOnly = hive {
+    deploy.nats.enable = true;
+    deploy.nats.autoGenerateCallout = true;
+    deploy.bao.clientCertFile = "/etc/pki/h1.pem";
+    deploy.bao.clientKeyFile = "/etc/pki/h1-key.pem";
+  };
+
   # A hive that is not the queue's host, with nothing about the queue's
   # address set by hand: what every hive but one in a multi-host swarm looks
   # like. The controller is on too, since it may run away from the queue.
@@ -215,6 +233,34 @@ let
         && lib.hasInfix "[ -s /var/lib/swarm-bao-pki/nats.pem ]" allLocal.systemd.services.swarm-bao-pki.script
         && lib.hasInfix "swarm-nats \"\" clientAuth" allLocal.systemd.services.swarm-bao-pki.script;
     }
+    {
+      # The hive's own reader is not the queue's identity, and no path is
+      # derived from it: a queue host without the store that holds only the
+      # hive's reader gets the leaf unit that fails naming the options, like
+      # one holding nothing.
+      name = "a queue host without the store is refused when it holds only the hive's reader";
+      ok =
+        let
+          u = queueWithHiveReaderOnly.systemd.services.swarm-bao-nats-tls;
+        in
+        queueWithHiveReaderOnly.services.hyperhive.deploy.nats.baoClientCertFile == null
+        && !(u.environment ? BAO_CLIENT_CERT)
+        && lib.hasInfix "services.hyperhive.deploy.nats.baoClient{Cert,Key}File" u.script;
+    }
+    {
+      # The default is the file the minting unit writes, wherever the hive's
+      # own reader is pointed.
+      name = "on the store's host the queue's leaf is the one minted there, not one beside the hive's reader";
+      ok =
+        let
+          n = natsOnStoreHostReaderMoved.services.hyperhive.deploy.nats;
+          mint = natsOnStoreHostReaderMoved.systemd.services.swarm-bao-pki.script;
+        in
+        n.baoClientCertFile == "/var/lib/swarm-bao-pki/nats.pem"
+        && n.baoClientKeyFile == "/var/lib/swarm-bao-pki/nats-key.pem"
+        && lib.hasInfix "[ -s /var/lib/swarm-bao-pki/nats.pem ] ||" mint
+        && lib.hasInfix "/var/lib/swarm-bao-pki nats " mint;
+    }
     {
       name = "the server requires TLS: no allow_non_tls";
       ok = !(natsContainer.services.nats.settings ? allow_non_tls);