hive-tls: the gateway leaf uses the services-issuer identity, not a hive's

swarm-services-cert issues the swarm-services leaf a self-signed gateway
serves, and on a host fronting no swarm name fetches the store's pki root.
It is gated on the gateway, not on a hive, yet its leaf pair was named
under deploy.hive-controller.tls and defaulted from the hive reader's cert
directory, and the root fetch presented the hive's own identity. A gateway
host with no hive had no such identity, so that branch was red by
construction.

- The pair moves to deploy.bao.servicesIssuerClient{Cert,Key}File, beside
  the store's other host-unit readers, and glue-bao-tls.nix defaults it on
  the store's host from the leaf it already mints. The old
  deploy.hive-controller.tls.baoClient{Cert,Key}File paths are
  mkRenamedOptionModule aliases. glue-services-issuer-bao-identity.nix,
  which derived the default from deploy.bao.clientCertFile, is gone.
- The no-swarm-name root fetch presents the services-issuer pair. The hive
  identity is now only hive-tls-resign's.
- A self-signed gateway with no pair fails evaluation, naming both options.
  A pair named but unreadable still fails the unit, naming the paths.

Refs #4921

nix/module-eval/swarm-otel-identity.nix

@@ -27,9 +27,12 @@ let
   # hive's telemetry with nothing to push authenticated with, which is the
   # already-supported degrade `haveCollectorSecret` names above the module's
   # `let`. What this fixture is for is checking the reading unit itself does
-  # not render, rather than rendering with an env var nothing filled in.
+  # not render, rather than rendering with an env var nothing filled in. Its
+  # gateway has a certificate of its own: a self-signed one needs the
+  # services-issuer identity.
   otelNoIdentity = hive {
     deploy.swarm-otel.enable = true;
+    gateway.tls.certDir = "/var/lib/acme/t.local";
     swarm.authelia.url = "https://auth.example.invalid";
     deploy.forgejo.sso.clientSecretFile = "/var/lib/forgejo-oidc/by-hand.secret";
   };