matrix: drop the per-hive appservice and its unused token

Every hive's homeserver loaded a per-hive `hyperhive` appservice
registration, and the swarm minted and delivered an as_token for it
through bao. No client presented that token: swarm-controller creates
every `@hive-<hive>` sender and every agent account with the swarm
appservice token (hive_sender.rs, agent_token.rs), and no Rust code read
the per-hive one.

Removed, with everything that existed only to serve it:
- hive-matrix.nix: the `hyperhive` registration, its activation-time
  render, the host bind mount of /var/lib/hyperhive/matrix-appservice,
  its LoadCredential entry, and the internal options
  `deploy.matrix.appserviceTokenFile` / `appserviceRegistrationScript`.
  tuwunel now loads only the swarm registration.
- glue-matrix-bao-token.nix and its `swarm-bao-matrix-token` unit.
- glue-bao-tls.nix: the matrix-token leaf and its defaults.
- swarm-bao.nix: the `swarm-matrix-token-<hive>` roles and policies
  (`swarm-bao-matrix-token-policy`), and the options
  `deploy.bao.matrixTokenClient{Cert,Key}File` and
  `matrixTokenCommonNamePrefix`, now mkRemovedOptionModule.
- swarm-secret-publisher.nix: the per-hive token mint and its state dir.
- swarm.nix: the reserved `<matrixTokenCommonNamePrefix>-<hive>` CN.
- swarm-secret-client: `matrix::appservice_token_path`.

The swarm registration (swarm-matrix-ctl, swarm-controller) is untouched.
Comments and docs that pointed at the removed glue file now point at
glue-queue-agent-credential.nix, which has the same reader shape.

Refs #4428

nix/host-modules/glue-queue-agent-credential.nix

@@ -1,9 +1,8 @@
 # Glue: this hive's agent queue credential comes out of the secret store.
 #
-# The store's second reader, and deliberately the same shape as its first
-# (./glue-matrix-bao-token.nix): a cert login that fails LOUDLY because every
-# state it fails on is one a retry fixes, then a read that degrades QUIETLY
-# because no retry turns "no value there" into a value.
+# A cert login that fails LOUDLY because every state it fails on is one a
+# retry fixes, then a read that degrades QUIETLY because no retry turns "no
+# value there" into a value.
 #
 # ⚠️ Two files, not one, and that is the consumer's shape rather than a
 # preference. `swarm_queue_client::QueueConfig::from_env` takes the secret as
@@ -15,15 +14,17 @@
 # that is correct rather than degraded. The publisher runs on the authelia
 # host and authelia mints on its first boot, so "nothing at that path yet" is
 # the ordinary early state of a swarm. Nothing here writes a local stand-in:
-# unlike a matrix appservice token there is no such thing as a locally valid
-# OIDC client secret, so a placeholder would turn a hive that cannot connect
+# there is no such thing as a locally valid OIDC client secret, so a placeholder would turn a hive that cannot connect
 # into one that is refused, which reaches the agent as a timeout.
 #
 # 📌 This runs wherever a client identity is configured, NOT only where the
-# store is — the rule ./glue-matrix-bao-token.nix states in full — and
-# wherever this host runs a hive (`deploy.hive-controller.enable`): the
-# credential is for the agents hive-c0re creates here at runtime, and the unit
-# writes under hive-c0re's own state directory.
+# store is. `deploy.bao.enable` would have been the co-location assumption
+# itself; the reader needs a certificate, not a neighbour. On the store's own
+# host ./glue-bao-tls.nix supplies one as a `mkDefault`; elsewhere an operator
+# places the leaf and names it, and the same unit works. It also needs this
+# host to run a hive (`deploy.hive-controller.enable`): the credential is for
+# the agents hive-c0re creates here at runtime, and the unit writes under
+# hive-c0re's own state directory.
 {
   pkgs,
   lib,
@@ -55,8 +56,8 @@ let
   # one thing a remote-store deployment has always had to place by hand. Only
   # used to decide whether a missing per-principal leaf is a mistake or a
   # deployment that has no store: a host holding neither is the supported
-  # no-store shape, and one holding this pair but not the pair above named
-  # seven of the eight options and stopped.
+  # no-store shape, and one holding this pair but not the pair above stopped
+  # short of naming this reader's own.
   hiveReaderIdentity = baoDeploy.clientCertFile != null && baoDeploy.clientKeyFile != null;
 
   credentialDir = toString deployCfg.hive-controller.queue.agentCredentialDir;