drop the shared hive agent login

Every agent now connects to the queue and reads logs with its own secret
from the store (#5181), so the per-hive `hive-<h>-agent` OIDC client has
no reader left. Remove it end to end:

- hive-c0re no longer forwards `hive-queue-agent-{secret,client-id}` into
  containers, and no longer forwards HIVE_AGENT_OIDC_TOKEN_ENDPOINT; the
  agent module that loaded them (nix/agent-modules/queue.nix) is gone, its
  options refused with a removal message.
- The host reader (glue-queue-agent-credential.nix, swarm-bao-queue-agent),
  its store role and policy unit (swarm-bao-queue-agent-policy), its PKI
  leaf and the deploy.bao.queueAgent* / queue.agentCredentialDir options
  are gone; the options are refused with a removal message.
- authelia mints no `hive-<h>-agent` client, and swarm-secret-publish no
  longer writes swarm/hives/<h>/queue/agent.
- swarm-secret-client drops queue::agent_client_path / queue::Credential.
- HIVE_AGENT_NATS_URL is now gated on the agents' queue address alone.

The log store's authelia check stays for operators. swarm-nats-auth still
refuses a `-agent` client id; that refusal and `agentClientSuffix` are left
for a follow-up.

Refs #4459
Refs #4765

swarm-secret-client/src/matrix.rs

@@ -95,7 +95,7 @@ pub fn hive_localpart(hive: &str) -> String {
 
 /// The path holding `hive`'s matrix sender account's homeserver access token.
 ///
-/// Keyed per **hive**, like [`crate::queue::agent_client_path`]. Under
+/// Keyed per **hive**, like [`crate::queue::hive_client_path`]. Under
 /// [`Kind::Hive`] the grant that reaches it is the hive's **own** stanza,
 /// `secret/data/swarm/hives/<this hive>/*`, which interpolates the name: hive
 /// `alpha` reads its own token and gets a 403 on `beta`'s.
@@ -137,7 +137,7 @@ pub fn swarm_appservice_token_path() -> Result<String, Error> {
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct Credential {
     /// Named `value` like [`crate::forge::Credential::value`] and
-    /// [`crate::queue::Credential::value`], so a nix-side reader spells
+    /// [`crate::queue::AgentCredential::value`], so a nix-side reader spells
     /// `bao kv get -field=value` for every kind.
     pub value: String,