render the matrix appservice registration from the store onto tmpfs

swarm-matrix-ctl appservice render now reads the registration's tokens
from the store and renders swarm.yaml under /run/swarm-matrix-appservice,
which tuwunel loads through LoadCredential. It mints a pair only when the
store answers and holds none; a host that has the old files stores their
pair once instead. A store that does not answer fails the unit and keeps
tuwunel down; sync starts it once the store answers.

Refs #4998 (item 3)

nix/host-modules/swarm-bao.nix

@@ -653,7 +653,8 @@ let
   # write, unlike either sibling, because sync compares before it writes.
   #
   # The second is the registration's tokens: the store's copy, which matrix-ctl
-  # seeds from the container's state dir and then follows. `create` and `read`
+  # creates (from the tokens an earlier version kept in the container, or a
+  # minted pair) and then follows. `create` and `read`
   # only, never `update`: a registration that exists is replaced by an
   # operator, not by a unit.
   #
@@ -2008,9 +2009,9 @@ in
       example = "swarm-matrix-ctl.svc";
       description = ''
         Subject the store's matrix-ctl cert-auth role accepts — the
-        identity the matrix container's `swarm-matrix-appservice-sync`
-        unit presents when it syncs the swarm appservice's registration and
-        publishes its token.
+        identity the matrix container's `swarm-matrix-appservice-render` and
+        `swarm-matrix-appservice-sync` units present when they fetch the swarm
+        appservice's registration and publish its token.
 
         A **third** identity rather than reuse of either sibling above. Its
         grant is that credential and the registration it derives from, plus