swarm CA: retire the host-held root CA, the store holds the only anchor

The secret store's pki root issues every hive's gateway leaf and the
swarm's service names, so the root swarm-ca.service generated on the
host anchors nothing and its key is a secret outside the store.

- swarm-ca.nix is gone: swarm-ca.service, root.pem and root-key.pem,
  and the swarm.ca.{autoConfigure,stateDir,validityDays} options. A
  definition of any of them fails evaluation with a removal message
  (swarm-ca-removed.nix), and a tmpfiles rule deletes /var/lib/swarm-ca
  on every host. singleHostSwarm no longer sets a swarm.* option.
- hive-tls-ca drops the $root slot: trust-bundle.pem holds the store's
  pki root and a hive CA's public ca.pem/ca-previous.pem only.
- hivectl peer-config no longer prints the scp line for the swarm root;
  the store's pki root is the one step.
- The gateway's cert import no longer stands a hive leaf or a throwaway
  in for a missing swarm-services leaf where it Requires= the issuing
  unit: it fails, naming swarm-services-cert.service. The stand-in stays
  where the gateway does not wait (no swarm name, or the store's UI
  only, whose passthrough must start with the store sealed).

Comments and docs that named swarm-ca.nix, swarm.ca.* or the host root
now name the store's pki root.

Refs #4588

nix/host-modules/hive-tls.nix

@@ -8,7 +8,6 @@ let
   cfg = config.services.hyperhive.deploy.hive-controller.tls;
   hyperhiveCfg = config.services.hyperhive;
   gatewayCfg = config.services.hyperhive.gateway;
-  swarmCaCfg = config.services.hyperhive.swarm.ca;
   domain = hyperhiveCfg.domain;
   baoCfg = hyperhiveCfg.swarm.bao;
   baoDeploy = hyperhiveCfg.deploy.bao;
@@ -346,15 +345,6 @@ in
   };
 
   config = lib.mkIf active {
-    # 🚫 There is deliberately NO warning that these service names are
-    # outside this hive's domain and this host cannot sign for them. The
-    # services leaf comes from the secret store's `pki` mount, which every
-    # hive reaches over the network with its own identity, so holding the
-    # swarm root key does not decide whether a hive can serve a
-    # swarm-service name. Such a warning would fire on every rebuild of
-    # every hive that is not the CA host, about a fallback that does not
-    # happen.
-
     # The state dir and the trust bundle. Never waits on the store: the
     # store's container is ordered after this unit, which writes the
     # bundle it bind-mounts, so the leaf is `hive-tls-resign`'s.
@@ -366,8 +356,6 @@ in
       # turn `Requires=`. Order against the unit that reads the dir.
       before = [ "hive-gateway-self-signed-cert.service" ];
       requiredBy = [ "hive-gateway-self-signed-cert.service" ];
-      # The bundle carries the swarm root where this host generates it.
-      #
       # `swarm-services-cert` is NOT ordered against this unit in either
       # direction, and the absence is load-bearing — see the cycle spelled
       # out at that unit. It runs after the store's container, the container
@@ -381,7 +369,6 @@ in
       # "$svcroot" ]` guard is what makes that state legal rather than fatal,
       # and `swarm-services-cert` restarts this unit once the root it wrote
       # is new — so the bundle converges instead of being a boot behind.
-      after = lib.optionals swarmCaCfg.autoConfigure [ "swarm-ca.service" ];
       serviceConfig = {
         Type = "oneshot";
         RemainAfterExit = true;
@@ -396,7 +383,6 @@ in
 
         ca="$d/ca.pem"
         prev="$d/ca-previous.pem"
-        root=${lib.escapeShellArg "${swarmCaCfg.stateDir}/root.pem"}
         svcroot="$d/swarm-services-root.pem"
 
         # --- Trust bundle: what a consumer must TRUST. Why it is a set of
@@ -423,7 +409,6 @@ in
         anchors=()
         if [ -s "$ca" ]; then anchors+=("$ca"); fi
         if [ -s "$prev" ]; then anchors+=("$prev"); fi
-        if [ -s "$root" ]; then anchors+=("$root"); fi
         if [ -s "$svcroot" ]; then anchors+=("$svcroot"); fi
         # `cat` with no arguments reads stdin, so no anchor at all is an
         # empty file until `swarm-services-cert` writes the root.
@@ -834,10 +819,7 @@ in
         # flattening the chain: the issuer here is a self-signed root, so
         # appending it would ship an anchor a client either already holds
         # — in which case it is redundant — or does not, in which case
-        # shipping it proves nothing. The old file appended the services
-        # sub-CA because that WAS an intermediate, and a client anchored
-        # on the swarm root could not build the middle of the chain by
-        # itself.
+        # shipping it proves nothing.
         mv -f "$d/swarm-services-leaf.new" "$svcleaf"
         mv -f "$d/swarm-services-key.pem.new" "$d/swarm-services-key.pem"
         chmod 0644 "$svcleaf"