swarm-bao-pki: sign every other hive's three store leaves

The store host's `swarm-bao-pki` now also signs, for every hive in
`swarm.hives` other than its own, the reader (`<hive>`), queue-agent
(`<queueAgentCommonNamePrefix>-<hive>`) and gateway-leaf
(`<hiveLeafCommonNamePrefix>-<hive>`) leaves, into
/var/lib/swarm-bao-pki/hives/<hive>/ with the basenames the own hive's
leaves use. Same CA, same `signLeaf`, idempotent on absence like every
other leaf in the unit. `signLeaf` now takes the CA from the top of the
PKI directory rather than from the leaf's directory; every existing
caller passed that directory, so their output is unchanged.

The operator still copies the files to the other hive's host and names
them in config; only the openssl step against the CA goes away
(mara on #5016, c95685: "ok mint").

Closes #5016

nix/host-modules/glue-queue-agent-credential.nix

@@ -147,8 +147,9 @@ in
             would evaluate, deploy and log in — and undo the split.
 
             On a hive that runs the store, glue-bao-tls.nix supplies both as
-            defaults and there is nothing to do. Elsewhere the leaf is issued
-            from that CA out of band and named here — see docs/swarm/secrets.md.
+            defaults and there is nothing to do. Elsewhere copy the pair from
+            /var/lib/swarm-bao-pki/hives/<hive>/ on the store's host and name it
+            here — see docs/swarm/bao.md.
           '';
         }
       ];