swarm-controller: revoke matrix admin from former operators

The operator admin sync now also takes homeserver admin away. It records
each user id it sends `make-user-admin` for in
`operator-matrix-admins.json` under the controller's state directory
(written to a temporary file and renamed over it; a missing file is an
empty set). On each pass, a recorded account that is no longer in
authelia's `admins` group but is still joined to `#admins:<server>` is
sent `!admin users force-leave-room <user> <admin room id>` as `@swarm`,
over the same `/_matrix` path the grant uses. Leaving that room is what
ends tuwunel admin.

It never revokes an admin it didn't grant, `@swarm`, tuwunel's server
user (`@conduit:<server>`), an agent's account (the store's
`hive-agent-*` cert roles, the same roster the agent account mint uses),
or anyone in the new `services.hyperhive.swarm.matrix.adminSync.ignoreUsers`
list. That list reaches the daemon as
`SWARM_CONTROLLER_MATRIX_ADMIN_SYNC_IGNORE_USERS`. It also never sends a
revoke that would leave `#admins` with no member besides `@swarm` and the
server user.

A revoke is sent at most once per account per controller process, like a
grant. A recorded account that is out of both the group and the room is
dropped from the file.

Closes #4799

docs/agent-lifecycle/persistence.md

@@ -472,6 +472,14 @@ rather than accepting deliveries it can't verify. Everything else the
 controller serves is unaffected.
 <!-- vale write-good.Passive = YES -->
 
+- `operator-matrix-admins.json` — the matrix user ids the operator admin
+  sync has made homeserver admin, a JSON array. The sync revokes admin
+  only from these, so deleting the file leaves every current admin in
+  place; a missing file is an empty set. A file the controller can't
+  read or parse stops the sync, grants included, and the controller logs
+  `operator matrix admin: pass failed` on every pass. See
+  [`docs/integrations/matrix.md`](../integrations/matrix.md#operators-are-homeserver-admins).
+
 ## Run-time dirs
 
 `/run/hyperhive/` is tmpfs-backed (systemd `RuntimeDirectory=`) but

docs/integrations/matrix.md

@@ -181,15 +181,29 @@ each member not yet in `#admins:<server_name>` it sends
 `<name>` is the authelia username lowercased, the account an SSO login
 lands on.
 
-- **Grant-only.** Removing someone from `admins` leaves their matrix
-  admin in place: tuwunel has no command that takes it away.
+- **Leaving `admins` revokes what the sync granted.** The controller
+  records each account it sends a grant for in
+  `/var/lib/swarm-controller/operator-matrix-admins.json`. When one of
+  them is no longer in `admins` but still in `#admins`, it sends
+  `!admin users force-leave-room @<name>:<server_name> <admin room id>`
+  there as `@swarm`; leaving that room is what ends homeserver admin.
+- **Admins the sync didn't make keep admin.** An admin missing from that
+  file, `@swarm`, the server user `@conduit:<server_name>`, every agent's
+  account, and every user id in
+  `services.hyperhive.swarm.matrix.adminSync.ignoreUsers` are never
+  revoked.
+- **The last admin stays.** A revoke that would leave no admin in
+  `#admins` besides `@swarm` and the server user isn't sent; the
+  controller logs a warning on each pass instead.
 - **No account, no grant.** A member who has never logged in to matrix
   has no account to promote. The first pass after their first SSO login
   promotes them.
-- **One command per member per controller run.** A member still missing
-  from `#admins` after it's sent gets a `make-user-admin … failed to take`
-  warning in the controller log on each later pass, and no second command
-  until the controller restarts.
+- **One command per account per controller run.** A member still missing
+  from `#admins` after the controller sends its grant gets a
+  `make-user-admin … failed to take` warning in the controller log on
+  each later pass, and no second command until the controller restarts;
+  a revoke that leaves its account in `#admins` gets
+  `force-leave-room … failed to take` the same way.
 - Runs only on a controller with both
   `services.hyperhive.deploy.swarm-controller.authBridgeUrl` and
   `services.hyperhive.deploy.swarm-controller.matrixHomeserverUrl` set.