docs: split credentials.md into an overview and a per-secret reference

The overview keeps the store invariant, the mTLS exception and the
minter/reader/renewal contract. The table of every credential and the
operating notes (forge token checks, re-creating agents, revoking a queue
credential, store login retries) move unchanged to credentials-reference.md,
and the links that asked where a credential lives point there.

docs/swarm/README.md

@@ -43,7 +43,8 @@ grafana, the controller, authelia, …) →
   → [`sso.md`](sso.md)
 - **secrets** — every credential the swarm holds, who mints it and where it
   lives → [`secrets.md`](secrets.md) · the per-secret minter/reader/renewal
-  contract → [`credentials.md`](credentials.md) · how the store comes up,
+  contract → [`credentials.md`](credentials.md), per credential in
+  [`credentials-reference.md`](credentials-reference.md) · how the store comes up,
   who writes its grants and how it unseals → [`bao.md`](bao.md)
 - **swarm CA** — the store root every hive's gateway leaf chains to, and what to
   hand a peer. → [`ca.md`](ca.md)
@@ -168,7 +169,7 @@ it's stored in the queue, not in the daemon.
 
 An agent connects to the queue as itself, with a credential `swarm-controller`
 mints for it when it creates the agent (`swarm/agents/<agent>/queue` in the
-secret store, see [`credentials.md`](credentials.md)). The harness reads it from
+secret store, see [`credentials-reference.md`](credentials-reference.md)). The harness reads it from
 the store under the agent's own certificate before each connection attempt and
 holds it in memory only. The one thing to configure is where the queue is: