hive-tls: issue the gateway leaf from bao with a per-hive identity

Every hive gets its own store identity (CN
<deploy.bao.hiveLeafCommonNamePrefix>-<hive>) and its own role on the
existing pki mount (<deploy.bao.hiveLeafPkiRolePrefix>-<hive>), whose
allowed_domains is the hive's domain and *.<domain>. The policy grants
update on that one issue path. swarm-bao-hive-leaf-policy writes role,
policy and cert-auth role for every hive in swarm.hives; the store's host
mints its own hive's identity in glue-bao-tls.nix and a new glue file
points deploy.hive-controller.tls.baoHiveIdentity{Cert,Key}File at it.
Hives on other hosts place it by hand. swarm.nix reserves the composed CN.

hive-tls-ca no longer generates a hive CA or signs a leaf: caGenScript,
signLeafScript/signHiveLeaf and the adoption block are gone, ca-key.pem
is deleted where it exists, and the unit only assembles trust-bundle.pem.
The retired ca.pem/ca-previous.pem stay in the bundle so leaves they
signed keep verifying.

hive-tls-resign becomes the bao issuance: at boot, on deploy and from a
daily timer it re-issues when the leaf is missing, past half the role's
lifetime, missing a name, or not chained to the store's pki root. Nothing
orders the gateway after it, so a valid leaf on disk never waits on the
store; a failed renewal leaves the leaf in place. A missing identity
fails the unit naming both options, as does the root fetch on a hive
fronting no swarm name, which now presents this identity instead of the
reader cert.

caValidityDays and leafValidityDays are removed (both spellings), since
nothing reads them.

Refs #4588

nix/host-modules/swarm.nix

@@ -55,16 +55,17 @@ let
     deployCfg.bao.granterCommonName
     deployCfg.bao.natsAuthCommonName
   ]
-  # The two per-hive readers' subjects, spelled out per hive rather than as the
-  # prefix. The prefix alone would reserve the wrong string: the role for hive
+  # The per-hive subjects, spelled out per hive rather than as the prefix.
+  # The prefix alone would reserve the wrong string: the role for hive
   # `h` accepts `<prefix>-h`, so the name a hive must not BE is that composed
   # spelling, and a hive named it would present a leaf that role accepts.
   #
-  # Both spellings are reserved for every declared hive, including the one the
+  # Every spelling is reserved for every declared hive, including the one the
   # CN belongs to — a hive cannot be named after its own reader either.
   ++ lib.concatMap (hive: [
     "${deployCfg.bao.matrixTokenCommonNamePrefix}-${hive}"
     "${deployCfg.bao.queueAgentCommonNamePrefix}-${hive}"
+    "${deployCfg.bao.hiveLeafCommonNamePrefix}-${hive}"
   ]) hiveNames;
 
   # Public hostnames of the swarm's own services, in declaration order.