docs(#3422): the user store is one file, not two

Six places asserted the old design as fact, and none of them mention the
change by name -- the class of doc breakage that is found by asking what
a diff made untrue, not by grepping for a feature:

- swarmctl/README.md and swarm-authelia-bridge/README.md both described
  their own private canonical store. The bridge's "known limitation"
  section described the seam as unsolved; it is what this fixes, so it
  becomes what both writers must uphold instead.
- docs/swarm/{sso,ui,secrets}.md described a rendered artifact.
- The repo CLAUDE.md entry for swarmctl said the same.
- docs/tools/swarmctl-cli.md is regenerated (CI diffs it against the
  clap tree), picking up the removed --store flag.

Operator-facing where it is read: the hand-editing consequence (values
survive a rewrite, comments do not) is stated in sso.md, where an
operator is being told to edit the file, rather than only in a module doc.

docs/swarm/secrets.md

@@ -47,7 +47,7 @@ Every row below is read against one of these.
 | authelia OIDC issuer key (RSA) | same unit | `/var/lib/authelia-swarm/oidc-issuer.key` | same — relying parties verify against the **public** half at `/jwks.json` |
 | OIDC client secret, plaintext half | `authelia crypto hash generate --random` | `/var/lib/authelia-swarm/oidc-clients/<id>.secret` | operator provides the file and names it in the service's `sso.clientSecretFile` |
 | OIDC client secret, digest half | the same mint | `oidc-clients/<id>.digest` | authelia's own half; merged at runtime via `settingsFiles` |
-| authelia subject store | `swarmctl` | `users.json` (canonical) → `users.yml` (rendered) | `swarmctl`, on the host that runs authelia |
+| authelia subject store | `swarmctl` and `swarm-authelia-bridge` | `users.yml` — one file, read and written by both | `swarmctl`, on the host that runs authelia |
 | wireguard private key | **the operator** — `wg genkey` | whatever `swarm.wireguard.privateKeyFile` names | always operator-provided; nothing generates this for you |
 | queue auth-callout nkeys (user seed + account seed) | `swarm-nats-callout-keys` first-boot unit, when `nats.autoGenerateCallout` is set | `/var/lib/swarm-nats-callout/{callout-user,issuer}.seed`, `0600` | operator mints both with `nk` and names them in `nats.calloutUserSeedFile` / `nats.calloutIssuerSeedFile` |
 

docs/swarm/sso.md

@@ -48,9 +48,14 @@ this password is stored nowhere — record it now
 ```
 
 The password is generated, hashed, and printed once; only the hash is
-kept. `swarmctl` writes its canonical `users.json`, re-renders authelia's
-`users.yml` from it, and restarts authelia. Full reference:
-[`../tools/swarmctl-cli.md`](../tools/swarmctl-cli.md).
+kept. `swarmctl` reads and writes authelia's `users.yml` directly — it is
+the one user store, shared with `swarm-authelia-bridge`, which creates
+agent identities in the same file. No restart: authelia watches it. Full
+reference: [`../tools/swarmctl-cli.md`](../tools/swarmctl-cli.md).
+
+You can edit `users.yml` by hand, and `swarmctl` will read what you
+wrote. ⚠️ It rewrites the whole file on every change, so **comments and
+formatting do not survive**; values and unrecognised keys do.
 
 This step stays manual on purpose. Bootstrapping an identity provider
 non-interactively means a secret arriving from somewhere — a file, an
@@ -125,8 +130,8 @@ presenting as "the forge is broken", several layers from its cause.
 ### 2. Swarm-managed services
 
 The controller side owns provisioning: `swarmctl` writes both halves, the
-same way it already owns authelia's user store (`users.json` canonical,
-`users.yml` a rendered artifact).
+same way it already owns authelia's user store (`users.yml`, read and
+written in place).
 
 ### 3. A hive elsewhere
 

docs/swarm/ui.md

@@ -45,8 +45,8 @@ would have meant those accounts silently failing a check they were
 supposed to pass.
 
 An account created without any group needs re-adding with the flag —
-`swarmctl` treats the existing entry as the canonical store, so the group
-is what changes.
+`swarmctl` reads the existing entry out of `users.yml`, so the group is
+what changes.
 
 Why a group and not a list of usernames: agents are getting authelia
 accounts of their own (matrix SSO), and *authenticated* would then

docs/tools/swarmctl-cli.md

@@ -25,8 +25,9 @@ swarm-level operator CLI
 ###### **Options:**
 
 * `--authelia-bin <PATH>` — authelia binary used to hash passwords. The argon2 parameters must match the verifier's, so this has to be the *configured* package rather than whatever is on `PATH`
-* `--users-file <PATH>` — Host-side path of authelia's users database — i.e. the path inside the container, prefixed with the container's root
-* `--store <PATH>` — Canonical user store
+* `--users-file <PATH>` — Host-side path of authelia's users database — i.e. the path inside the container, prefixed with the container's root.
+
+   This is the only user store: it is read before every change and written in place, and `swarm-authelia-bridge` writes the same file.
 
 
 
@@ -40,7 +41,7 @@ Manage subjects in the swarm's SSO provider
 
 * `add` — Add a user, generating a password for them
 * `update` — Change an existing user's attributes
-* `list` — List every user in the canonical store
+* `list` — List every user in authelia's users database
 
 
 
@@ -85,9 +86,9 @@ Every flag is optional and they compose, so one call can set several things at o
 
 ## `swarmctl user list`
 
-List every user in the canonical store.
+List every user in authelia's users database.
 
-Reads `store` only — never authelia's rendered `users.yml`, which is a derived artifact this crate writes and never reads back (see the crate doc comment). One line per user: username, display name, email (if set), groups (if any).
+Read-only: it never writes the file. Shows every subject in it, including agent identities `swarm-authelia-bridge` created — one line per user: username, display name, email (if set), groups (if any).
 
 **Usage:** `swarmctl user list`