hive-tls: the gateway leaf uses the services-issuer identity, not a hive's

swarm-services-cert issues the swarm-services leaf a self-signed gateway
serves, and on a host fronting no swarm name fetches the store's pki root.
It is gated on the gateway, not on a hive, yet its leaf pair was named
under deploy.hive-controller.tls and defaulted from the hive reader's cert
directory, and the root fetch presented the hive's own identity. A gateway
host with no hive had no such identity, so that branch was red by
construction.

- The pair moves to deploy.bao.servicesIssuerClient{Cert,Key}File, beside
  the store's other host-unit readers, and glue-bao-tls.nix defaults it on
  the store's host from the leaf it already mints. The old
  deploy.hive-controller.tls.baoClient{Cert,Key}File paths are
  mkRenamedOptionModule aliases. glue-services-issuer-bao-identity.nix,
  which derived the default from deploy.bao.clientCertFile, is gone.
- The no-swarm-name root fetch presents the services-issuer pair. The hive
  identity is now only hive-tls-resign's.
- A self-signed gateway with no pair fails evaluation, naming both options.
  A pair named but unreadable still fails the unit, naming the paths.

Refs #4921

nix/host-modules/glue-bao-tls.nix

@@ -107,6 +107,8 @@ in
       forwarderOidcClientKeyFile = lib.mkDefault "${pkiDir}/forwarder-oidc-key.pem";
       ciRunnerClientCertFile = lib.mkDefault "${pkiDir}/ci-runner.pem";
       ciRunnerClientKeyFile = lib.mkDefault "${pkiDir}/ci-runner-key.pem";
+      servicesIssuerClientCertFile = lib.mkDefault "${pkiDir}/services-issuer.pem";
+      servicesIssuerClientKeyFile = lib.mkDefault "${pkiDir}/services-issuer-key.pem";
 
       # The granter: every `swarm-bao-*-policy` unit on this host logs in with
       # it. ⚠️ Unlike every other leaf here, never the file an operator copies:
@@ -224,8 +226,8 @@ in
         [ -s ${pkiDir}/forwarder-oidc.pem ] || ${signLeaf} ${pkiDir} forwarder-oidc \
           ${lib.escapeShellArg deployCfg.bao.forwarderOidcCommonName} "" clientAuth
 
-        # The identity a hive presents to ask the store's `pki` mount for the
-        # swarm-services certificate its gateway serves. Minted here like the
+        # The identity a gateway host presents to ask the store's `pki` mount
+        # for the swarm-services certificate it serves. Minted here like the
         # three above, and the reason is the sharpest of the four: this leaf
         # is what OPENS the mint, so it cannot come out of it. A certificate
         # authority that issues the credential admitting you to it is the