swarm CA: retire the host-held root CA, the store holds the only anchor

The secret store's pki root issues every hive's gateway leaf and the
swarm's service names, so the root swarm-ca.service generated on the
host anchors nothing and its key is a secret outside the store.

- swarm-ca.nix is gone: swarm-ca.service, root.pem and root-key.pem,
  and the swarm.ca.{autoConfigure,stateDir,validityDays} options. A
  definition of any of them fails evaluation with a removal message
  (swarm-ca-removed.nix), and a tmpfiles rule deletes /var/lib/swarm-ca
  on every host. singleHostSwarm no longer sets a swarm.* option.
- hive-tls-ca drops the $root slot: trust-bundle.pem holds the store's
  pki root and a hive CA's public ca.pem/ca-previous.pem only.
- hivectl peer-config no longer prints the scp line for the swarm root;
  the store's pki root is the one step.
- The gateway's cert import no longer stands a hive leaf or a throwaway
  in for a missing swarm-services leaf where it Requires= the issuing
  unit: it fails, naming swarm-services-cert.service. The stand-in stays
  where the gateway does not wait (no swarm name, or the store's UI
  only, whose passthrough must start with the store sealed).

Comments and docs that named swarm-ca.nix, swarm.ca.* or the host root
now name the store's pki root.

Refs #4588

nix/host-modules/hive-c0re/default.nix

@@ -128,10 +128,10 @@ in
     ./theme.nix
     # Hive-CA trust for this daemon's outbound TLS. The matrix provisioning
     # URL (`swarm.matrix.apiUrl`) defaults to https on the homeserver's
-    # gateway vhost, which serves a leaf chaining to the store's services
-    # root or the swarm root — CAs generated at runtime, which no
-    # build-time trust store can contain. The queue's TLS is verified
-    # against `HIVE_C0RE_OIDC_CA_FILE` (../hive-tls.nix), not this bundle.
+    # gateway vhost, which serves a leaf chaining to the store's pki root —
+    # a CA generated at runtime, which no build-time trust store can
+    # contain. The queue's TLS is verified against `HIVE_C0RE_OIDC_CA_FILE`
+    # (../hive-tls.nix), not this bundle.
     #
     # ⚠️ `SSL_CERT_FILE` REPLACES the trust store, and unlike the other
     # consumers of this helper, hive-c0re already makes a *public*-TLS call: