swarm-secret-client: hives no longer read swarm/services/*

The hive policy rendered by policy::render granted every hive cert read
on secret/data/swarm/services/*, which holds each swarm service's OIDC
client secret. No reader of that tree authenticates with a hive cert:
grafana, the otel collector and the store forwarder each read with
their own leaf, and the bao UI's secret is read by the store's granter.

render() now emits two stanzas: swarm/agents/* and the hive's own
swarm/hives/<hive>/*. Kind::Service had no other caller and is removed.
Docs and comments that described the grant as a decision are rewritten
to the current state.

Closes #4960

nix/host-modules/swarm-secret-publisher.nix

@@ -60,8 +60,7 @@ let
 
   # The swarm's own services, as opposed to its hives. One client for the whole
   # swarm rather than one per hive, so one value in the store rather than a copy
-  # each: `swarm/services/<id>/oidc/client`, under the `services` kind
-  # `swarm-secret-client`'s `path::Kind` declares.
+  # each: `swarm/services/<id>/oidc/client`.
   #
   # The ids come from `swarm.*`, which is identical on every host — that is what
   # lets this host name a service's client while running none of them, and it is
@@ -267,9 +266,8 @@ in
           fi
         '') serviceClientIds}
 
-        # The controller's own client, under `controller/` rather than
-        # `services/`: every hive reads `services/*`, and this client may read
-        # every hive's status. The nix half of
+        # The controller's own client, under `controller/`, which no hive
+        # reads: this client may read every hive's status. The nix half of
         # `swarm_secret_client::queue::controller_client_path`.
         src=${lib.escapeShellArg "${deployCfg.authelia.hostClientSecretDir}/${controllerClientId}.secret"}
         if [ -s "$src" ]; then