swarm CA: retire the host-held root CA, the store holds the only anchor

The secret store's pki root issues every hive's gateway leaf and the
swarm's service names, so the root swarm-ca.service generated on the
host anchors nothing and its key is a secret outside the store.

- swarm-ca.nix is gone: swarm-ca.service, root.pem and root-key.pem,
  and the swarm.ca.{autoConfigure,stateDir,validityDays} options. A
  definition of any of them fails evaluation with a removal message
  (swarm-ca-removed.nix), and a tmpfiles rule deletes /var/lib/swarm-ca
  on every host. singleHostSwarm no longer sets a swarm.* option.
- hive-tls-ca drops the $root slot: trust-bundle.pem holds the store's
  pki root and a hive CA's public ca.pem/ca-previous.pem only.
- hivectl peer-config no longer prints the scp line for the swarm root;
  the store's pki root is the one step.
- The gateway's cert import no longer stands a hive leaf or a throwaway
  in for a missing swarm-services leaf where it Requires= the issuing
  unit: it fails, naming swarm-services-cert.service. The stand-in stays
  where the gateway does not wait (no swarm name, or the store's UI
  only, whose passthrough must start with the store sealed).

Comments and docs that named swarm-ca.nix, swarm.ca.* or the host root
now name the store's pki root.

Refs #4588

nix/host-modules/hive-matrix.nix

@@ -12,7 +12,7 @@ let
   hyperhiveDomain = config.services.hyperhive.domain;
 
   # Same runtime→build-time bridge hive-forge and swarm-ci-runner cross:
-  # binds the hive trust bundle (which folds in the swarm root) into the
+  # binds the hive trust bundle (which folds in the store's root) into the
   # container and orders the container after `hive-tls-ca.service`. The
   # assembled bundle itself comes from `caTrust.trustBundle`, imported in
   # the container config below.
@@ -783,10 +783,9 @@ in
 
           # Swarm-internal trust reaches tuwunel at RUNTIME, not via
           # `security.pki.certificateFiles`. That option is read when the
-          # system is BUILT, and the swarm root is deliberately a runtime
-          # file (`swarm.ca.stateDir`) because its key must never enter the
-          # store — so there is nothing build-time to name. The bind-mount
-          # above plus the bundle service below are what replaced it.
+          # system is BUILT, and the store's root is a runtime file fetched
+          # from the store at boot — so there is nothing build-time to name.
+          # The bind-mount above plus the bundle service below carry it.
 
           # tuwunel hard-fails to boot if `/etc/resolv.conf` has no
           # `nameserver` line (`Failed to configure DNS resolver ... no