docs(#3422): the user store is one file, not two

Six places asserted the old design as fact, and none of them mention the
change by name -- the class of doc breakage that is found by asking what
a diff made untrue, not by grepping for a feature:

- swarmctl/README.md and swarm-authelia-bridge/README.md both described
  their own private canonical store. The bridge's "known limitation"
  section described the seam as unsolved; it is what this fixes, so it
  becomes what both writers must uphold instead.
- docs/swarm/{sso,ui,secrets}.md described a rendered artifact.
- The repo CLAUDE.md entry for swarmctl said the same.
- docs/tools/swarmctl-cli.md is regenerated (CI diffs it against the
  clap tree), picking up the removed --store flag.

Operator-facing where it is read: the hand-editing consequence (values
survive a rewrite, comments do not) is stated in sso.md, where an
operator is being told to edit the file, rather than only in a module doc.

CLAUDE.md

@@ -153,9 +153,9 @@ hand-maintained per-file tree drifts out of sync with the code.
   **root and acts directly** — no socket, no HTTP route, no priv helper;
   the crate's README records why the rootless shape was examined and
   rejected. Does not link `swarm-controller`, mirroring `hivectl` ÷
-  `hive-c0re`. ⚠️ Its user store is **two files, one authoritative**:
-  `users.json` is canonical, authelia's `users.yml` is a *rendered
-  artifact* that is written and never read back. Full, always-current
+  `hive-c0re`. ⚠️ Its user store is authelia's own **`users.yml`, read and
+  written in place** — one file, shared with `swarm-authelia-bridge`; see
+  that crate's README for what both writers must uphold. Full, always-current
   verb reference (CI-enforced against the clap tree, same pattern as
   `hivectl`'s — see `docs/conventions.md`):
   [`docs/tools/swarmctl-cli.md`](docs/tools/swarmctl-cli.md).