nix: unbreak the swarm-services leaf the gateway waits on

Three defects in the store-issued path, each of which alone kept nginx
from starting at all. The gateway's cert import `Requires=` this leaf, so
a leaf that is never issued is not a name mismatch — it is an empty
listener, and the swarm's own forge stopped answering on :443.

`swarm-services-cert` declared `Before=hive-tls-ca` for the trust
bundle's sake while also being `After=` the store's container, which is
itself `After=hive-tls-ca`. systemd resolved the cycle the only way it
can, by deleting the job, so the leaf went unissued on every activation.
The edge is gone; the bundle converges the other way round, through the
restart this unit already performed when the root it wrote was new.

The `pki` mount was enabled without `-max-lease-ttl`, so bao clamped the
30-year root to the 768h default and then refused every issue call,
because a leaf of the mount's own default length would outlive the CA
signing it. The mount is tuned on every run, the role pins a 720h leaf,
and a root that can no longer cover one is replaced rather than left to
refuse forever. A hive tests its own copy of that certificate against the
same threshold, so both ends reach a fresh leaf without signalling.

`swarm-bao-pki` mints the services-issuer leaf that opens the mount, but
only `swarm-bao-certs` required it. `RemainAfterExit` plus an
already-active unit means an activation that ADDS a leaf mints nothing —
which is how a host whose config named `services-issuer.pem` came to have
no such file. A target wants it now, like every sibling granting unit.

nix/host-modules/glue-bao-tls.nix

@@ -118,6 +118,16 @@ in
       description = "mint the swarm secret store's own CA and leaves";
       before = [ "swarm-bao-certs.service" ];
       requiredBy = [ "swarm-bao-certs.service" ];
+      # 🩸 A target wants this, not only `swarm-bao-certs`, and the reason is
+      # what happens when the LIST of leaves grows. `requiredBy` alone is
+      # satisfied by a unit that already ran: this one is `RemainAfterExit`,
+      # so an activation that adds a leaf here finds it active, pulls nothing,
+      # and the new leaf is never minted — while every sibling granting unit,
+      # each of which carries this line, was re-run by the same activation.
+      # That is how `services-issuer.pem` came to be missing on a host whose
+      # config named it, leaving `swarm-services-cert` to fail on an absent
+      # file until someone restarted this by hand.
+      wantedBy = [ "multi-user.target" ];
       path = [
         pkgs.openssl
         pkgs.coreutils