bring existing agent cert roles to the 1h token ttl on controller start

docs/swarm/credentials.md

@@ -468,7 +468,15 @@ The longest hold is the controller's forge work, which stops after two minutes.
 A client that keeps a `SecretStore` handle longer than an hour must log in
 again, because nothing renews the token. A role the controller writes takes the
 TTL at its next write: a hive's at the controller's start, an agent's at its
-next certificate renewal. At that rate an hour keeps about 700 tokens live.
+next certificate mint or renewal. At its start the controller also reads every
+existing `hive-agent-*` role and, for one whose `token_ttl` or `token_max_ttl`
+differs from the TTL, writes those two fields and no others. The store keeps the
+fields a write leaves out, so the role's certificate, allowed names and
+policies stay. A role already at the TTL isn't written. The start logs one line
+with `rewritten`, `already_current` and `failed` counts, and a role that fails
+gets a warning that names it, then the pass moves on. Tokens issued before
+expire on their own; the controller revokes nothing. At that rate an hour keeps
+about 700 tokens live.
 
 The granter's role keeps 15 minutes. Only the one-time bootstrap token writes
 it, and a deployed store never rewrites it, so the longer TTL would not reach