swarm: log in to bao before reading or writing a secret

`BAO_CLIENT_CERT` decides which certificate the TLS handshake presents. It is
not an identity: cert auth is a login, and a `bao kv` call without a token asks
its token helper for one instead — a `sh` neither unit carries on `path`.

Measured on this host, from `swarm-bao-matrix-token.service`:

  swarm-bao did not return secret/swarm/matrix/registration-token
  failed to get token helper: error expanding config path "":
    exec: "sh": executable file not found in $PATH

So the first credential meant to travel through the store never has, and the
publisher added last week would not have either.

`-token-only` rather than a plain login: storing is the default, and it stores
through that same helper, so the obvious form reproduces the failure one line
further down. It is `-field=token -no-store`, which keeps the token on stdout
and out of the filesystem.

The two units degrade differently on purpose, and that is preserved. The matrix
fetch is `Wants=`-only and must not hold up the homeserver, so a refused login
reports why and keeps the token already in place. The publisher is
`Restart=on-failure`, where a store that cannot authenticate this host is worth
retrying and "published 0" would read as an ordinary quiet day.

`swarm-bao.nix` is untouched: it authenticates with the bootstrap token from a
file, which is a real identity and not a cert exchange. Its shape is where the
export idiom here comes from.

nix/host-modules/glue-matrix-bao-token.nix

@@ -112,6 +112,22 @@ in
         err="$(mktemp)"
         trap 'rm -f "$err"' EXIT
 
+        # Cert auth is a login, not a transport setting. The `BAO_CLIENT_*`
+        # variables above only decide which certificate the TLS handshake
+        # presents; without a token `bao` asks its token helper instead, and
+        # that is a `sh` this unit's `path` does not carry. `-token-only`
+        # answers on stdout and skips the helper on both sides.
+        if ! BAO_TOKEN="$(bao login -method=cert -token-only 2>"$err")"; then
+          echo "could not log in to swarm-bao with this host's certificate; keeping the token hive-matrix already has." >&2
+          if [ -s "$err" ]; then
+            cat "$err" >&2
+          else
+            echo "bao failed without writing a diagnostic." >&2
+          fi
+          exit 0
+        fi
+        export BAO_TOKEN
+
         if ! token="$(bao kv get -field=value ${lib.escapeShellArg tokenPath} 2>"$err")"; then
           echo "swarm-bao did not return ${tokenPath}; keeping the token hive-matrix already has." >&2
           if [ -s "$err" ]; then

nix/host-modules/swarm-secret-publisher.nix

@@ -143,6 +143,18 @@ in
       script = ''
         set -euo pipefail
 
+        # Cert auth is a login, not a transport setting. The `BAO_CLIENT_*`
+        # variables above only decide which certificate the TLS handshake
+        # presents; without a token `bao` asks its token helper instead, and
+        # that is a `sh` this unit's `path` does not carry. `-token-only`
+        # answers on stdout and skips the helper on both sides.
+        #
+        # Unhandled on purpose: `Restart=on-failure` above is what a store that
+        # cannot authenticate this host should get. Degrading here would report
+        # "published 0" as an ordinary quiet day.
+        BAO_TOKEN="$(bao login -method=cert -token-only)"
+        export BAO_TOKEN
+
         published=0
         skipped=0