drop the shared hive agent login

Every agent now connects to the queue and reads logs with its own secret
from the store (#5181), so the per-hive `hive-<h>-agent` OIDC client has
no reader left. Remove it end to end:

- hive-c0re no longer forwards `hive-queue-agent-{secret,client-id}` into
  containers, and no longer forwards HIVE_AGENT_OIDC_TOKEN_ENDPOINT; the
  agent module that loaded them (nix/agent-modules/queue.nix) is gone, its
  options refused with a removal message.
- The host reader (glue-queue-agent-credential.nix, swarm-bao-queue-agent),
  its store role and policy unit (swarm-bao-queue-agent-policy), its PKI
  leaf and the deploy.bao.queueAgent* / queue.agentCredentialDir options
  are gone; the options are refused with a removal message.
- authelia mints no `hive-<h>-agent` client, and swarm-secret-publish no
  longer writes swarm/hives/<h>/queue/agent.
- swarm-secret-client drops queue::agent_client_path / queue::Credential.
- HIVE_AGENT_NATS_URL is now gated on the agents' queue address alone.

The log store's authelia check stays for operators. swarm-nats-auth still
refuses a `-agent` client id; that refusal and `agentClientSuffix` are left
for a follow-up.

Refs #4459
Refs #4765

nix/container-modules/swarm-secret-publisher.nix

@@ -1,6 +1,6 @@
 # The unit that puts swarm-level secrets into the swarm's secret store, so
-# whoever needs one can read it there: a hive its own and its agents'
-# credentials, a service or the controller its own. It mints nothing: every
+# whoever needs one can read it there: a hive, a service or the controller its
+# own. It mints nothing: every
 # value is an OIDC client secret authelia minted, and this unit copies it.
 #
 # Imported inside authelia's container, beside the mint: it reads each secret
@@ -61,14 +61,6 @@ in
               example = "secret/swarm/services/swarm-grafana/oidc/client";
               description = "KV path its reader fetches the value from.";
             };
-            withClientId = lib.mkOption {
-              type = lib.types.bool;
-              default = false;
-              description = ''
-                Also store the client id beside the value, as `client_id`, for
-                a reader that has to reconstruct it from the store alone.
-              '';
-            };
           };
         }
       );
@@ -170,7 +162,7 @@ in
             # `value="$(cat "$src")"` would publish it to /proc for anyone in
             # the container to read.
             bao kv put ${lib.escapeShellArg s.path} \
-              value=@"$src"${lib.optionalString s.withClientId " client_id=${lib.escapeShellArg s.clientId}"}
+              value=@"$src"
             published=$((published + 1))
           else
             # Not an error: authelia mints on its FIRST BOOT, so an absent file