docs(#3422): the user store is one file, not two

Six places asserted the old design as fact, and none of them mention the
change by name -- the class of doc breakage that is found by asking what
a diff made untrue, not by grepping for a feature:

- swarmctl/README.md and swarm-authelia-bridge/README.md both described
  their own private canonical store. The bridge's "known limitation"
  section described the seam as unsolved; it is what this fixes, so it
  becomes what both writers must uphold instead.
- docs/swarm/{sso,ui,secrets}.md described a rendered artifact.
- The repo CLAUDE.md entry for swarmctl said the same.
- docs/tools/swarmctl-cli.md is regenerated (CI diffs it against the
  clap tree), picking up the removed --store flag.

Operator-facing where it is read: the hand-editing consequence (values
survive a rewrite, comments do not) is stated in sso.md, where an
operator is being told to edit the file, rather than only in a module doc.

swarm-authelia-bridge/README.md

@@ -32,10 +32,29 @@ simply owns the file it writes. No elevated privilege anywhere.
   `swarm-controller` (loopback) and a split-host one (bind wider + firewall)
   with no separate transport.
 
-## Known limitation
+## One store, two writers
 
-`swarmctl` still writes an independent `users.json`/`users.yml` for human
-accounts, assuming co-location with `swarm-controller`'s host. Two
-canonical stores for the same physical file is a real seam, not solved
-here — routing `swarmctl` through this bridge too is a plausible follow-up,
-out of scope for the agent-identity slice this crate shipped with.
+This bridge and `swarmctl` both read and write authelia's `users.yml`
+directly. That is the whole arrangement — neither keeps a private copy it
+considers canonical.
+
+It used to be otherwise, and the seam was real: each side had its own
+`users.json` treated as authoritative, rendering the *same* physical
+`users.yml`. A writer whose own JSON was missing could not tell "nothing
+here yet" from "someone else's users", so it refused to write at all —
+which is exactly what a hive with existing users hit (#3422).
+
+What still has to hold, since two processes share the file:
+
+- **Read before write.** Both do, so neither can drop a user the other
+  added between operations.
+- **Unknown keys survive.** Both carry unmodelled top-level and per-user
+  fields through a round-trip, or whichever writes second would silently
+  delete what the first added.
+- **Every user gets an email.** A relying party asking for the claim fails
+  rather than degrades, so both write paths fill in a synthetic address
+  when none was supplied.
+
+Neither restarts authelia: it watches the file. `swarmctl` *could* (it is
+root); this bridge deliberately cannot, and a reload that depends on which
+process wrote is not a reload.