drop the shared hive agent login

Every agent now connects to the queue and reads logs with its own secret
from the store (#5181), so the per-hive `hive-<h>-agent` OIDC client has
no reader left. Remove it end to end:

- hive-c0re no longer forwards `hive-queue-agent-{secret,client-id}` into
  containers, and no longer forwards HIVE_AGENT_OIDC_TOKEN_ENDPOINT; the
  agent module that loaded them (nix/agent-modules/queue.nix) is gone, its
  options refused with a removal message.
- The host reader (glue-queue-agent-credential.nix, swarm-bao-queue-agent),
  its store role and policy unit (swarm-bao-queue-agent-policy), its PKI
  leaf and the deploy.bao.queueAgent* / queue.agentCredentialDir options
  are gone; the options are refused with a removal message.
- authelia mints no `hive-<h>-agent` client, and swarm-secret-publish no
  longer writes swarm/hives/<h>/queue/agent.
- swarm-secret-client drops queue::agent_client_path / queue::Credential.
- HIVE_AGENT_NATS_URL is now gated on the agents' queue address alone.

The log store's authelia check stays for operators. swarm-nats-auth still
refuses a `-agent` client id; that refusal and `agentClientSuffix` are left
for a follow-up.

Refs #4459
Refs #4765

nix/host-modules/swarm-authelia-service.nix

@@ -352,22 +352,14 @@ in
       readOnly = true;
       default = "-agent";
       description = ''
-        Suffix appended to a hive's own client id to name the client its
-        *agent containers* present — agents on hive `alpha` all present
-        `${config.services.hyperhive.swarm.authelia.hiveClientPrefix}alpha${config.services.hyperhive.swarm.authelia.agentClientSuffix}`.
-        Read-only for the same reason as `hiveClientPrefix`, and read by the
-        same consumer with the same failure mode: a split spelling denies
-        every agent as a timeout.
+        Suffix the queue's auth-callout responder refuses on a hive's client
+        id: `${config.services.hyperhive.swarm.authelia.hiveClientPrefix}alpha${config.services.hyperhive.swarm.authelia.agentClientSuffix}`
+        is denied, never read as hive `alpha-agent`. No client is minted with
+        it; an agent authenticates to the queue with its own secret.
 
-        A suffix on the hive's id rather than a prefix of its own, because
-        `agent-alpha` reads as *the agent named alpha* — which is precisely
-        what this identity does not say.
-
-        One id per hive rather than per agent, because agents are created at
-        runtime and a per-agent client would make creating one a config
-        change plus a reload. The consequence is that this identity says
-        *which hive* an agent belongs to and never *which agent* — the
-        broker cannot tell two agents on one hive apart.
+        Read-only for the same reason as `hiveClientPrefix`. A hive named with
+        this suffix is refused at evaluation, since the queue would refuse its
+        own client id.
       '';
     };