swarm-controller: create each hive's cert-auth role at startup

A hive holds an mTLS pair and a policy naming what it may read, and still
cannot log in: nothing creates the role that maps its certificate to that
policy. The one pre-shared credential in the system therefore buys no
access.

Minting happens here rather than in nix, which was the first plan. Nix
mints from the store's own container, and that path is gated on the
bootstrap token -- so onboarding a hive later would mean placing the one
genuinely pre-shared secret again. Doing it from the controller costs a
public certificate authority as an input and makes the bootstrap token
one-time.

A startup pass, not a hook: the hive list is loaded once and a config
change means a redeploy, so the roles are as static as the list. Only the
policy is derived from something that moves.

The subject is the hive's name because glue-bao-tls.nix mints a hive's
client leaf with its name as the CN, and cert auth matches on that.

Per-hive failures are logged and skipped, matching the queue, bridge and
forge connects above it: a controller whose store is unreachable still
serves everything else, and the next start retries.

Not covered by a test: ensure_hive_roles is IO from end to end, and the
seam that would make it assertable is the one the read-grant sink already
has. Said here rather than implied by a green suite.

swarm-controller/src/main.rs

@@ -1623,11 +1623,15 @@ async fn main() -> Result<()> {
     let state_forge = keep_forge_for_state(forge_client, webhook_secret.clone());
 
     let hives = load_hives();
-    // Before serving, because a hive whose policy does not exist cannot read
-    // anything this daemon writes for it. Same "log and carry on" shape as
-    // every connect above.
-    read_policy::ensure_hive_policies(&hives.iter().map(|h| h.name.clone()).collect::<Vec<_>>())
-        .await;
+    // Before serving, because a hive whose role does not exist cannot log in,
+    // and one whose policy does not exist logs in able to read nothing —
+    // either way it cannot collect what this daemon writes for it. Policy
+    // first: the role names the policy, so writing it the other way round
+    // leaves a window where the role points at nothing. Same "log and carry
+    // on" shape as every connect above.
+    let hive_names: Vec<String> = hives.iter().map(|h| h.name.clone()).collect();
+    read_policy::ensure_hive_policies(&hive_names).await;
+    read_policy::ensure_hive_roles(&hive_names).await;
 
     let state = AppState {
         hives: Arc::new(hives),