drop the shared hive agent login

Every agent now connects to the queue and reads logs with its own secret
from the store (#5181), so the per-hive `hive-<h>-agent` OIDC client has
no reader left. Remove it end to end:

- hive-c0re no longer forwards `hive-queue-agent-{secret,client-id}` into
  containers, and no longer forwards HIVE_AGENT_OIDC_TOKEN_ENDPOINT; the
  agent module that loaded them (nix/agent-modules/queue.nix) is gone, its
  options refused with a removal message.
- The host reader (glue-queue-agent-credential.nix, swarm-bao-queue-agent),
  its store role and policy unit (swarm-bao-queue-agent-policy), its PKI
  leaf and the deploy.bao.queueAgent* / queue.agentCredentialDir options
  are gone; the options are refused with a removal message.
- authelia mints no `hive-<h>-agent` client, and swarm-secret-publish no
  longer writes swarm/hives/<h>/queue/agent.
- swarm-secret-client drops queue::agent_client_path / queue::Credential.
- HIVE_AGENT_NATS_URL is now gated on the agents' queue address alone.

The log store's authelia check stays for operators. swarm-nats-auth still
refuses a `-agent` client id; that refusal and `agentClientSuffix` are left
for a follow-up.

Refs #4459
Refs #4765

nix/host-modules/glue-bao-tls.nix

@@ -95,15 +95,13 @@ in
       # 🩸 The readers below each present a leaf of their own rather than
       # `client.pem` above. The leaf is what bao sees, so this pairing is the
       # whole of what turns "one principal with the union of their grants" into
-      # one principal per grant — see ./swarm-bao.nix's `perHiveReaders` block
-      # for the grants themselves.
+      # one principal per grant — see ./swarm-bao.nix's `readStanza` block for
+      # the grants themselves.
       #
       # Defaulted here rather than in `glue-<consumer>-bao-identity.nix` files:
       # those exist where the consumer is a CONTAINER with a
       # `deploy.<service>.*` namespace of its own to point at. These are host
       # units reading the store, which is the pairing this file already is.
-      queueAgentClientCertFile = lib.mkDefault "${pkiDir}/queue-agent.pem";
-      queueAgentClientKeyFile = lib.mkDefault "${pkiDir}/queue-agent-key.pem";
       grafanaOidcClientCertFile = lib.mkDefault "${pkiDir}/grafana-oidc.pem";
       grafanaOidcClientKeyFile = lib.mkDefault "${pkiDir}/grafana-oidc-key.pem";
       otelOidcClientCertFile = lib.mkDefault "${pkiDir}/otel-oidc.pem";
@@ -223,20 +221,10 @@ in
         # principal holding the union of their grants, and the union would
         # include every agent credential in the swarm.
         #
-        # ⚠️ The first carries THIS hive's name in the subject, unlike the three
-        # service leaves above. Its grant names one hive's path, because a queue
-        # credential lives under `swarm/hives/<name>/` and every hive runs a
-        # reader for its own; ./swarm-bao.nix writes one role per hive in the
-        # swarm directory to match. The OIDC readers need no such segment — a
-        # client is registered once per swarm.
-        #
         # Minted whether or not the consumer runs here, for the reason the three
         # leaves above give: on a hive that does not run the store this is the
         # file an operator copies, and a leaf that only appears where its
         # consumer does is one nobody can copy from anywhere.
-        [ -s ${pkiDir}/queue-agent.pem ] || ${signLeaf} ${pkiDir} queue-agent \
-          ${lib.escapeShellArg "${deployCfg.bao.queueAgentCommonNamePrefix}-${clientCn}"} "" clientAuth
-
         [ -s ${pkiDir}/grafana-oidc.pem ] || ${signLeaf} ${pkiDir} grafana-oidc \
           ${lib.escapeShellArg deployCfg.bao.grafanaOidcCommonName} "" clientAuth
 
@@ -344,14 +332,14 @@ in
         ${lib.optionalString deployCfg.hive-controller.enable ''
           # This hive's gateway-leaf identity, which opens
           # `pki/issue/<hiveLeafPkiRolePrefix>-<hive>` and nothing else. Its
-          # subject carries this hive's name, like the queue-agent leaf
-          # above, because ./swarm-bao.nix writes one role
-          # per hive. Only where a hive runs; the other hives' are below.
+          # subject carries this hive's name, because ./swarm-bao.nix writes
+          # one role per hive. Only where a hive runs; the other hives' are
+          # below.
           [ -s ${pkiDir}/hive-leaf.pem ] || ${signLeaf} ${pkiDir} hive-leaf \
             ${lib.escapeShellArg "${deployCfg.bao.hiveLeafCommonNamePrefix}-${clientCn}"} "" clientAuth
         ''}
 
-        # The reader, queue-agent and gateway-leaf leaves of every other hive in
+        # The reader and gateway-leaf leaves of every other hive in
         # the swarm directory: the files an operator copies to that hive's
         # host. One directory per hive, with the basenames this hive's leaves
         # use, so a hive's set is one directory to copy.
@@ -364,8 +352,6 @@ in
             install -d -m 0700 ${d}
             [ -s ${d}/client.pem ] || ${signLeaf} ${d} client \
               ${lib.escapeShellArg h} "" clientAuth
-            [ -s ${d}/queue-agent.pem ] || ${signLeaf} ${d} queue-agent \
-              ${lib.escapeShellArg "${deployCfg.bao.queueAgentCommonNamePrefix}-${h}"} "" clientAuth
             [ -s ${d}/hive-leaf.pem ] || ${signLeaf} ${d} hive-leaf \
               ${lib.escapeShellArg "${deployCfg.bao.hiveLeafCommonNamePrefix}-${h}"} "" clientAuth
           ''