make bao readers want swarm-bao-pki and drop its start limit

A pki start refused by its start limit failed every reader that
Requires= it with `dependency`. That leaves a unit inactive, not
failed, so Restart=on-failure never fired and readers without a
refresh timer never ran again (#5381: grafana 502 for ~43 min).

Readers and granting units now Wants= + After= pki; one whose leaf is
still missing fails its login with exit 1 into its existing retry.
pki gets StartLimitIntervalSec=0: it is deliberately not
RemainAfterExit, so each reader's start re-runs it.

docs/swarm/bao.md

@@ -100,6 +100,10 @@ principal — and points `deploy.bao.serverCertFile`, `.serverKeyFile` and
 It runs at every boot and every deploy, and before each start of a container
 that loads one of its leaves, and signs only the files that are missing, so a
 leaf a deploy adds, or a service a deploy enables, has its file on that deploy.
+The store's readers and granting units on this host order after it and want it,
+but none requires it: when a run fails, each of them still starts, and one
+whose leaf is missing fails its login into its own retry. It has no start
+limit, since a mass container start pulls it in once for each unit it starts.
 
 Those are `mkDefault`s, so naming your own paths wins. Do that when your
 certificates come from a real internal CA; the store has no opinion about