swarm CA: retire the host-held root CA, the store holds the only anchor

The secret store's pki root issues every hive's gateway leaf and the
swarm's service names, so the root swarm-ca.service generated on the
host anchors nothing and its key is a secret outside the store.

- swarm-ca.nix is gone: swarm-ca.service, root.pem and root-key.pem,
  and the swarm.ca.{autoConfigure,stateDir,validityDays} options. A
  definition of any of them fails evaluation with a removal message
  (swarm-ca-removed.nix), and a tmpfiles rule deletes /var/lib/swarm-ca
  on every host. singleHostSwarm no longer sets a swarm.* option.
- hive-tls-ca drops the $root slot: trust-bundle.pem holds the store's
  pki root and a hive CA's public ca.pem/ca-previous.pem only.
- hivectl peer-config no longer prints the scp line for the swarm root;
  the store's pki root is the one step.
- The gateway's cert import no longer stands a hive leaf or a throwaway
  in for a missing swarm-services leaf where it Requires= the issuing
  unit: it fails, naming swarm-services-cert.service. The stand-in stays
  where the gateway does not wait (no swarm name, or the store's UI
  only, whose passthrough must start with the store sealed).

Comments and docs that named swarm-ca.nix, swarm.ca.* or the host root
now name the store's pki root.

Refs #4588

nix/module-eval/swarm-services-switch.nix

@@ -287,30 +287,50 @@ let
             lib.elem "hive-gateway-self-signed-cert.service" s.swarm-services-cert.requiredBy
             && lib.elem "hive-gateway-self-signed-cert.service" s.swarm-services-cert.before;
           # The cert it installs on the default and swarm-services paths:
-          # the services leaf when present, a throwaway pair otherwise.
-          importsServicesLeafOrFallback =
+          # the services leaf when present.
+          importsServicesLeaf =
             m:
             let
               imp = m.systemd.services.hive-gateway-self-signed-cert;
             in
             lib.hasInfix "cert=/var/lib/hive-tls/swarm-services.pem" imp.script
-            && lib.hasInfix "openssl req -x509" imp.script
-            && lib.hasInfix "cert=/var/lib/hive-gateway/tls/fallback.pem" imp.script
             && lib.hasInfix ''install -m 0644 "$cert" /var/lib/hive-gateway/tls/cert.pem'' imp.script
-            && lib.hasInfix ''install -m 0644 "$cert" /var/lib/hive-gateway/tls/swarm-services.pem'' imp.script
+            && lib.hasInfix ''install -m 0644 "$cert" /var/lib/hive-gateway/tls/swarm-services.pem'' imp.script;
+          # Without it: a throwaway pair where the gateway does not wait for
+          # the leaf, a failure naming the issuing unit where it does.
+          standsInThrowaway =
+            m:
+            let
+              imp = m.systemd.services.hive-gateway-self-signed-cert;
+            in
+            lib.hasInfix "openssl req -x509" imp.script
+            && lib.hasInfix "cert=/var/lib/hive-gateway/tls/fallback.pem" imp.script
             && lib.any (p: lib.hasPrefix "openssl" (p.pname or (p.name or ""))) imp.path;
+          failsWithoutLeaf =
+            m:
+            let
+              s = m.systemd.services.hive-gateway-self-signed-cert.script;
+            in
+            lib.hasInfix "swarm-services-cert.service issues it" s
+            && lib.hasInfix "exit 1" s
+            && !(lib.hasInfix "fallback.pem" s);
           store = storeOnlyNoHive;
           hs = swarmServicesHere.systemd.services;
         in
         noHive swarmServicesOnly
         && noHive swarmServicesOnlyNoStore
         && noHive store
-        && importsServicesLeafOrFallback swarmServicesOnly
-        && importsServicesLeafOrFallback swarmServicesOnlyNoStore
-        && importsServicesLeafOrFallback store
-        # Fronting many swarm names: the gateway waits for their leaf.
+        && importsServicesLeaf swarmServicesOnly
+        && importsServicesLeaf swarmServicesOnlyNoStore
+        && importsServicesLeaf store
+        # Fronting many swarm names: the gateway waits for their leaf, and
+        # its import fails without it.
         && waitsForLeaf swarmServicesOnly
         && waitsForLeaf swarmServicesOnlyNoStore
+        && failsWithoutLeaf swarmServicesOnly
+        && failsWithoutLeaf swarmServicesOnlyNoStore
+        && standsInThrowaway store
+        && !(failsWithoutLeaf store)
         # The store's UI alone: its nginx carries the passthrough to the
         # store, so it starts on the fallback with the store sealed.
         &&