matrix: drop the per-hive appservice and its unused token

Every hive's homeserver loaded a per-hive `hyperhive` appservice
registration, and the swarm minted and delivered an as_token for it
through bao. No client presented that token: swarm-controller creates
every `@hive-<hive>` sender and every agent account with the swarm
appservice token (hive_sender.rs, agent_token.rs), and no Rust code read
the per-hive one.

Removed, with everything that existed only to serve it:
- hive-matrix.nix: the `hyperhive` registration, its activation-time
  render, the host bind mount of /var/lib/hyperhive/matrix-appservice,
  its LoadCredential entry, and the internal options
  `deploy.matrix.appserviceTokenFile` / `appserviceRegistrationScript`.
  tuwunel now loads only the swarm registration.
- glue-matrix-bao-token.nix and its `swarm-bao-matrix-token` unit.
- glue-bao-tls.nix: the matrix-token leaf and its defaults.
- swarm-bao.nix: the `swarm-matrix-token-<hive>` roles and policies
  (`swarm-bao-matrix-token-policy`), and the options
  `deploy.bao.matrixTokenClient{Cert,Key}File` and
  `matrixTokenCommonNamePrefix`, now mkRemovedOptionModule.
- swarm-secret-publisher.nix: the per-hive token mint and its state dir.
- swarm.nix: the reserved `<matrixTokenCommonNamePrefix>-<hive>` CN.
- swarm-secret-client: `matrix::appservice_token_path`.

The swarm registration (swarm-matrix-ctl, swarm-controller) is untouched.
Comments and docs that pointed at the removed glue file now point at
glue-queue-agent-credential.nix, which has the same reader shape.

Refs #4428

nix/host-modules/deploy.nix

@@ -257,23 +257,18 @@ in
     # Both spellings of the registration token, removed rather than renamed:
     # the homeserver no longer accepts a shared registration secret at all,
     # so there is no path to point a definition at. Accounts are created by
-    # the hive's appservice, whose token lives at a fixed path this module
-    # deliberately does not let anyone move.
+    # the swarm's appservice.
     (lib.mkRemovedOptionModule [ "services" "hyperhive" "swarm" "matrix" "registrationTokenFile" ] ''
-      The matrix registration token is gone: hive-c0re creates accounts as the
-      hive's appservice instead, so there is no shared secret for tuwunel to
-      check. Remove this definition — nothing needs replacing, the appservice
-      token is minted and delivered automatically
-      (/var/lib/hyperhive/matrix-appservice-token, not operator-settable).
+      The matrix registration token is gone: swarm-controller creates accounts
+      as the swarm's appservice instead, so there is no shared secret for
+      tuwunel to check. Remove this definition — nothing needs replacing.
       The old token file at /var/lib/hyperhive/matrix-register-token is read by
       nothing now and can be deleted. See docs/integrations/matrix.md.
     '')
     (lib.mkRemovedOptionModule [ "services" "hyperhive" "deploy" "matrix" "registrationTokenFile" ] ''
-      The matrix registration token is gone: hive-c0re creates accounts as the
-      hive's appservice instead, so there is no shared secret for tuwunel to
-      check. Remove this definition — nothing needs replacing, the appservice
-      token is minted and delivered automatically
-      (/var/lib/hyperhive/matrix-appservice-token, not operator-settable).
+      The matrix registration token is gone: swarm-controller creates accounts
+      as the swarm's appservice instead, so there is no shared secret for
+      tuwunel to check. Remove this definition — nothing needs replacing.
       The old token file at /var/lib/hyperhive/matrix-register-token is read by
       nothing now and can be deleted. See docs/integrations/matrix.md.
     '')