matrix: drop the per-hive appservice and its unused token

Every hive's homeserver loaded a per-hive `hyperhive` appservice
registration, and the swarm minted and delivered an as_token for it
through bao. No client presented that token: swarm-controller creates
every `@hive-<hive>` sender and every agent account with the swarm
appservice token (hive_sender.rs, agent_token.rs), and no Rust code read
the per-hive one.

Removed, with everything that existed only to serve it:
- hive-matrix.nix: the `hyperhive` registration, its activation-time
  render, the host bind mount of /var/lib/hyperhive/matrix-appservice,
  its LoadCredential entry, and the internal options
  `deploy.matrix.appserviceTokenFile` / `appserviceRegistrationScript`.
  tuwunel now loads only the swarm registration.
- glue-matrix-bao-token.nix and its `swarm-bao-matrix-token` unit.
- glue-bao-tls.nix: the matrix-token leaf and its defaults.
- swarm-bao.nix: the `swarm-matrix-token-<hive>` roles and policies
  (`swarm-bao-matrix-token-policy`), and the options
  `deploy.bao.matrixTokenClient{Cert,Key}File` and
  `matrixTokenCommonNamePrefix`, now mkRemovedOptionModule.
- swarm-secret-publisher.nix: the per-hive token mint and its state dir.
- swarm.nix: the reserved `<matrixTokenCommonNamePrefix>-<hive>` CN.
- swarm-secret-client: `matrix::appservice_token_path`.

The swarm registration (swarm-matrix-ctl, swarm-controller) is untouched.
Comments and docs that pointed at the removed glue file now point at
glue-queue-agent-credential.nix, which has the same reader shape.

Refs #4428

nix/module-eval/secret-publisher.nix

@@ -243,41 +243,6 @@ let
         lib.hasInfix "secret/swarm/hives/h1/queue/agent" s
         && lib.hasInfix "secret/swarm/hives/h2/queue/agent" s;
     }
-    {
-      # The producer's end of the read `glue-matrix-bao-token.nix` already did.
-      # Both hives are asserted for the reason the queue case above gives: a
-      # publisher that knew one name rather than the roster would pass on a
-      # single-hive fixture and strand the second hive ever added — which is
-      # the two-hives-never-converge shape this slice exists to close.
-      name = "the publisher mints an appservice token for every hive and writes it to that hive's matrix path";
-      ok =
-        let
-          s = secretPublisherHere.systemd.services.swarm-secret-publish.script;
-        in
-        lib.hasInfix "secret/swarm/hives/h1/matrix/appservice-token" s
-        && lib.hasInfix "secret/swarm/hives/h2/matrix/appservice-token" s
-        && lib.hasInfix "/dev/urandom" s;
-    }
-    {
-      # What makes a re-publish idempotent. This principal is granted
-      # `create`/`update` and no `read`, so it cannot ask the store whether a
-      # hive already has a token — with nowhere to keep one, every run would
-      # mint a fresh value and rotate the swarm's token. A state directory is
-      # that somewhere, and nothing else in this unit needs one, so its absence
-      # means exactly this.
-      #
-      # The second arm is the mint's own guard: the state file is only written
-      # when it is missing or empty. Dropping that test leaves a unit that
-      # still has a state directory and still rotates on every boot.
-      name = "the publisher keeps the tokens it minted, and mints only when it holds none";
-      ok =
-        let
-          u = secretPublisherHere.systemd.services.swarm-secret-publish;
-        in
-        lib.hasInfix "matrix-appservice-token" (u.serviceConfig.StateDirectory or "")
-        && u.serviceConfig.StateDirectoryMode or null == "0700"
-        && lib.hasInfix "if [ ! -s \"$src\" ]" u.script;
-    }
     {
       # A property of the SET, not of one unit: both of these authenticate by
       # certificate, and `BAO_CLIENT_CERT` is transport rather than identity, so
@@ -306,7 +271,7 @@ let
             && !(lib.hasInfix "bao kv" (lib.head (lib.splitString "bao login" c)));
         in
         holdsTokenFirst secretPublisherHere.systemd.services.swarm-secret-publish.script
-        && holdsTokenFirst baoWithMatrix.systemd.services.swarm-bao-matrix-token.script
+        && holdsTokenFirst baoWithMatrix.systemd.services.swarm-bao-queue-agent.script
         # Controls, so a clean verdict above means something. In order: a bare
         # read is refused, a read placed before the login is refused, and a
         # login that exists only in a comment is refused — that last one is the