docs(#3422): the user store is one file, not two

Six places asserted the old design as fact, and none of them mention the
change by name -- the class of doc breakage that is found by asking what
a diff made untrue, not by grepping for a feature:

- swarmctl/README.md and swarm-authelia-bridge/README.md both described
  their own private canonical store. The bridge's "known limitation"
  section described the seam as unsolved; it is what this fixes, so it
  becomes what both writers must uphold instead.
- docs/swarm/{sso,ui,secrets}.md described a rendered artifact.
- The repo CLAUDE.md entry for swarmctl said the same.
- docs/tools/swarmctl-cli.md is regenerated (CI diffs it against the
  clap tree), picking up the removed --store flag.

Operator-facing where it is read: the hand-editing consequence (values
survive a rewrite, comments do not) is stated in sso.md, where an
operator is being told to edit the file, rather than only in a module doc.

swarmctl/README.md

@@ -23,21 +23,24 @@ a verb has to run as a non-root user or from another host, the answer is
 a **group-gated admin socket**, separate from the controller's `0666`
 gateway-facing one — not a widening of what root does here.
 
-## Two files, one of them authoritative
+## One file, two writers
 
-- `users.json` — canonical, ours, JSON.
-- `users.yml` — a **rendered artifact** for authelia. Written, never read
-  back.
+`users.yml` — authelia's own users database — is read and written
+directly. There is no second store.
 
-The split is what lets this crate work without a YAML parser: the
-workspace has none, and adding one costs a crates.io fetch, a lock update
-and a vendor hash for a schema we fully control and only ever emit.
+There used to be: a private `users.json` here, canonical, with `users.yml`
+rendered from it, while `swarm-authelia-bridge` kept its own pair against
+the *same* physical file. Two canonical stores for one file is a seam, and
+it bit — a writer whose own JSON was missing could not tell "nothing here
+yet" from "someone else's users", and refused to write (#3422).
 
-The shortcut of writing JSON into the `.yml` (JSON being a subset of
-YAML) is deliberately not taken: authelia refuses to start on a users file
-it cannot parse, so that file fronts the whole SSO provider's boot, and
-"almost certainly parses" is not a claim worth betting a boot on without
-running it.
+The argument for the split was that it let this crate work without a YAML
+parser. It didn't: the JSON was read back on every run, so the round-trip
+was already being paid — the two files differed only in *format*.
+
+⚠️ The file is round-tripped, so **comments and hand-formatting do not
+survive a write**. Values do, and so do keys this binary does not model.
+See `swarm-authelia-bridge/README.md` for what both writers must uphold.
 
 ## Configuration
 
@@ -53,7 +56,6 @@ an error.
 | `SWARMCTL_AUTHELIA_USERS_FILE` | host-side path of the users database |
 | `SWARMCTL_AUTHELIA_MACHINE` | container name, for `systemctl -M` |
 | `SWARMCTL_AUTHELIA_UNIT` | authelia's unit inside that container |
-| `SWARMCTL_STORE` | canonical store (defaults to the controller's state dir) |
 
 ## Usage