hive-tls: issue the gateway leaf from bao with a per-hive identity

Every hive gets its own store identity (CN
<deploy.bao.hiveLeafCommonNamePrefix>-<hive>) and its own role on the
existing pki mount (<deploy.bao.hiveLeafPkiRolePrefix>-<hive>), whose
allowed_domains is the hive's domain and *.<domain>. The policy grants
update on that one issue path. swarm-bao-hive-leaf-policy writes role,
policy and cert-auth role for every hive in swarm.hives; the store's host
mints its own hive's identity in glue-bao-tls.nix and a new glue file
points deploy.hive-controller.tls.baoHiveIdentity{Cert,Key}File at it.
Hives on other hosts place it by hand. swarm.nix reserves the composed CN.

hive-tls-ca no longer generates a hive CA or signs a leaf: caGenScript,
signLeafScript/signHiveLeaf and the adoption block are gone, ca-key.pem
is deleted where it exists, and the unit only assembles trust-bundle.pem.
The retired ca.pem/ca-previous.pem stay in the bundle so leaves they
signed keep verifying.

hive-tls-resign becomes the bao issuance: at boot, on deploy and from a
daily timer it re-issues when the leaf is missing, past half the role's
lifetime, missing a name, or not chained to the store's pki root. Nothing
orders the gateway after it, so a valid leaf on disk never waits on the
store; a failed renewal leaves the leaf in place. A missing identity
fails the unit naming both options, as does the root fetch on a hive
fronting no swarm name, which now presents this identity instead of the
reader cert.

caValidityDays and leafValidityDays are removed (both spellings), since
nothing reads them.

Refs #4588

nix/host-modules/deploy.nix

@@ -325,23 +325,45 @@ in
       [ "services" "hyperhive" "deploy" "singleHostSwarm" ]
     )
 
-    # The hive CA's own knobs. They sat at the TOP of `services.hyperhive`,
-    # which is meant to be everything about hyperhive rather than the settings
-    # of one hive — and where the CA lives, how long it lasts and how long its
-    # leaves last are decisions of the host that holds the key. `hive-controller`
-    # is hive-c0re's new name (mara, on the issue), so the daemon that owns the
-    # CA is what they hang off.
+    # The hive TLS state dir sat at the TOP of `services.hyperhive`, which is
+    # meant to be everything about hyperhive rather than the settings of one
+    # hive. `hive-controller` is hive-c0re's new name (mara, on the issue).
     (lib.mkRenamedOptionModule
       [ "services" "hyperhive" "tls" "stateDir" ]
       [ "services" "hyperhive" "deploy" "hive-controller" "tls" "stateDir" ]
     )
-    (lib.mkRenamedOptionModule
-      [ "services" "hyperhive" "tls" "caValidityDays" ]
+    # The hive CA's lifetime and its leaves', both spellings, removed rather
+    # than renamed: no hive CA is generated, and the store's per-hive role
+    # sets the gateway leaf's lifetime.
+    (lib.mkRemovedOptionModule [ "services" "hyperhive" "tls" "caValidityDays" ] ''
+      No hive CA is generated any more: the gateway leaf is issued by the
+      secret store's pki mount, whose per-hive role sets its lifetime
+      (services.hyperhive.deploy.bao.servicesPkiLeafTtlHours). Remove this
+      definition. See docs/swarm/ca.md.
+    '')
+    (lib.mkRemovedOptionModule [ "services" "hyperhive" "tls" "leafValidityDays" ] ''
+      No hive CA is generated any more: the gateway leaf is issued by the
+      secret store's pki mount, whose per-hive role sets its lifetime
+      (services.hyperhive.deploy.bao.servicesPkiLeafTtlHours). Remove this
+      definition. See docs/swarm/ca.md.
+    '')
+    (lib.mkRemovedOptionModule
       [ "services" "hyperhive" "deploy" "hive-controller" "tls" "caValidityDays" ]
+      ''
+        No hive CA is generated any more: the gateway leaf is issued by the
+        secret store's pki mount, whose per-hive role sets its lifetime
+        (services.hyperhive.deploy.bao.servicesPkiLeafTtlHours). Remove this
+        definition. See docs/swarm/ca.md.
+      ''
     )
-    (lib.mkRenamedOptionModule
-      [ "services" "hyperhive" "tls" "leafValidityDays" ]
+    (lib.mkRemovedOptionModule
       [ "services" "hyperhive" "deploy" "hive-controller" "tls" "leafValidityDays" ]
+      ''
+        No hive CA is generated any more: the gateway leaf is issued by the
+        secret store's pki mount, whose per-hive role sets its lifetime
+        (services.hyperhive.deploy.bao.servicesPkiLeafTtlHours). Remove this
+        definition. See docs/swarm/ca.md.
+      ''
     )
 
     # The WireGuard mesh, whole. Unlike every rename above this one moves a