matrix: remove the registration token

Nothing reads it any more: hive-c0re creates accounts as the hive's
appservice, so the mint, the host file, the bind mount, the
`LoadCredential` entry and tuwunel's `registration_token_file` all go.

⚠️ `allow_registration` has to go to `false` in the same change, and not
as hardening. tuwunel refuses to START when registration is allowed with
no token configured — it demands
`yes_i_am_very_very_sure_…_open_registration_…` instead — so dropping the
token and leaving the flag true is not a lax homeserver, it is one that
does not boot. The flag is checked only for requests arriving without an
appservice token, so hive-c0re provisions exactly as before and everyone
else is refused outright.

The swarm secret store keeps its role, repointed at the credential that
replaced the token (`swarm/hives/<hive>/matrix/appservice-token`). Its
unit now also re-runs hive-matrix's own registration renderer after
writing the file: the token is half an agreement, and a registration
still naming the previous value authenticates nobody. The renderer is
shared through an internal option rather than copied, so the
registration's shape has one home.

Both spellings of `registrationTokenFile` become
`mkRemovedOptionModule` with a message naming what replaced them. A hive
that never set the option — the default — is unaffected; one that pinned
it fails to evaluate with instructions instead of a silent no-op.

An upgraded hive needs no intervention: the activation script has both
halves in place before the homeserver restarts, existing agents keep the
tokens their devices already hold, and the old token file is left on
disk read by nothing. docs/integrations/matrix.md spells the path out.

Refs #4402

hive-c0re/src/matrix.rs

@@ -982,9 +982,8 @@ pub async fn ensure_admin_user(client: &reqwest::Client, as_token: &str) -> Resu
 /// admin is degraded, not broken. Only `hivectl matrix promote-user` /
 /// `reset-password` need it.
 ///
-/// # Errors
-/// Never — the outcome is the return value. `false` means "not admin and
-/// could not be made one", already logged with what to do about it.
+/// Returns whether the account holds admin rights now. A `false` has
+/// already been logged, with what to do about it.
 async fn ensure_admin_rights(
     client: &reqwest::Client,
     admin_token: &str,
@@ -1003,7 +1002,9 @@ async fn ensure_admin_rights(
             return true;
         }
         Some(_) => {
-            tracing::warn!("matrix: hive admin is not in the admin room — attempting to promote it")
+            tracing::warn!(
+                "matrix: hive admin is not in the admin room — attempting to promote it"
+            );
         }
         None => tracing::debug!(
             "matrix: could not read the hive admin's joined rooms; attempting to promote it"