hive-tls: the gateway leaf uses the services-issuer identity, not a hive's

swarm-services-cert issues the swarm-services leaf a self-signed gateway
serves, and on a host fronting no swarm name fetches the store's pki root.
It is gated on the gateway, not on a hive, yet its leaf pair was named
under deploy.hive-controller.tls and defaulted from the hive reader's cert
directory, and the root fetch presented the hive's own identity. A gateway
host with no hive had no such identity, so that branch was red by
construction.

- The pair moves to deploy.bao.servicesIssuerClient{Cert,Key}File, beside
  the store's other host-unit readers, and glue-bao-tls.nix defaults it on
  the store's host from the leaf it already mints. The old
  deploy.hive-controller.tls.baoClient{Cert,Key}File paths are
  mkRenamedOptionModule aliases. glue-services-issuer-bao-identity.nix,
  which derived the default from deploy.bao.clientCertFile, is gone.
- The no-swarm-name root fetch presents the services-issuer pair. The hive
  identity is now only hive-tls-resign's.
- A self-signed gateway with no pair fails evaluation, naming both options.
  A pair named but unreadable still fails the unit, naming the paths.

Refs #4921

nix/host-modules/deploy.nix

@@ -174,6 +174,17 @@ in
       [ "services" "hyperhive" "deploy" "ci-runner" "jobTimeout" ]
     )
 
+    # The gateway's services-issuer pair is a swarm-service identity, not a
+    # hive's, so it sits with the store's other host-unit readers.
+    (lib.mkRenamedOptionModule
+      [ "services" "hyperhive" "deploy" "hive-controller" "tls" "baoClientCertFile" ]
+      [ "services" "hyperhive" "deploy" "bao" "servicesIssuerClientCertFile" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "hyperhive" "deploy" "hive-controller" "tls" "baoClientKeyFile" ]
+      [ "services" "hyperhive" "deploy" "bao" "servicesIssuerClientKeyFile" ]
+    )
+
     # The runner toggle sat under `swarm.forge.ci` before `deploy.forgejo.ci`.
     # Both were per-host, so each forwards straight to its final path.
     (lib.mkRenamedOptionModule