swarm-controller: mint each agent's forge token and store it in bao

A MintAgentForgeToken node mints a fixed-name swarm-agent token with the
admin API, keeps it when the stored value's last eight and the normalised
scopes match the forge's list, and otherwise deletes and re-creates it.
The token is stored at swarm/agents/<agent>/forge-token. Agent creation
inserts the node, and a pass at start and every five minutes inserts it
for every agent holding a store identity whose token is missing or stale.

Refs #3782

swarm-secret-client/src/client.rs

@@ -260,6 +260,25 @@ impl SecretStore {
         .await?;
         Ok(())
     }
+
+    /// The names of every cert-auth role under `mount`, or none when the
+    /// mount has no roles at all.
+    ///
+    /// **Only a 404 is "none".** The store answers a `LIST` on an empty
+    /// directory with a 404; a denial is a 403 and stays an error, so a caller
+    /// iterating the result never mistakes "not allowed to look" for "nothing
+    /// there".
+    ///
+    /// # Errors
+    /// [`Error::Vault`] for anything that is not a 404: a denial, or an
+    /// unreachable store.
+    pub async fn list_cert_roles(&self, mount: &str) -> Result<Vec<String>, Error> {
+        match vaultrs::auth::cert::ca_cert_role::list(&self.inner, mount).await {
+            Ok(listed) => Ok(listed.keys),
+            Err(vaultrs::error::ClientError::APIError { code: 404, .. }) => Ok(Vec::new()),
+            Err(e) => Err(e.into()),
+        }
+    }
 }
 
 /// Write an ACL policy, spelled out here because [`vaultrs`] does not have it: