swarm-bao: make the reader's identity declarable, not just the store's

`swarm-bao.nix` declared the store's half of the mTLS pair as options —
`serverCertFile`, `serverKeyFile`, `clientCaFile` — and left the reader's
half as a literal inside `glue-bao-tls.nix`, which only runs where
`deploy.bao.enable` is set. A hive that did not host the store therefore
could not read from it and could not be pointed at a certificate even
when one had been placed by hand.

Adds `clientCertFile`, `clientKeyFile` and `serverCaFile` beside their
three server siblings, `mkDefault`ed by the glue to the leaf it already
mints, and moves `glue-matrix-bao-token.nix` onto them. Its gate becomes
"this host holds an identity" rather than "the store is a neighbour",
and the unit ordering that names store-local units is now conditional --
`Requires=` on an absent unit fails the job.

`serverCaFile` is separate from `clientCaFile` on purpose: one is the
store choosing which readers to trust, the other a reader choosing which
store to trust. Self-signing collapses them to one file, which is a
property of that deployment and not of the pairing.

Closes #3855.

nix/host-modules/glue-bao-tls.nix

@@ -73,6 +73,14 @@ in
       serverCertFile = lib.mkDefault "${pkiDir}/server.pem";
       serverKeyFile = lib.mkDefault "${pkiDir}/server-key.pem";
       clientCaFile = lib.mkDefault "${pkiDir}/ca.pem";
+
+      # A reader on this host, which happens to be the host that mints. Only
+      # these three are what a reader elsewhere needs placed by hand; that they
+      # collapse to the same CA file here is a property of self-signing, not of
+      # the pairing.
+      clientCertFile = lib.mkDefault "${pkiDir}/client.pem";
+      clientKeyFile = lib.mkDefault "${pkiDir}/client-key.pem";
+      serverCaFile = lib.mkDefault "${pkiDir}/ca.pem";
     };
 
     # Idempotent on ABSENCE, never on content. Re-issuing the CA invalidates