keep authelia's keys in bao, seeded from the existing key files

docs/swarm/credentials.md

@@ -71,11 +71,19 @@ neither is a renaming of the other.
 
 The rows are in the [reference](credentials-reference.md#swarm-level--one-of-each-per-swarm).
 
-Authelia mints the three keys for itself, in-container, precisely
-because nothing outside that container ever reads them. **That's the test worth
-applying to any secret added here** — and the client secret's plaintext half is
+Nothing outside authelia's container reads its keys (session, JWT, storage encryption,
+OIDC HMAC and the OIDC issuer), which is why no delivery step exists for them. **That's the
+test worth applying to any secret added here** — and the client secret's plaintext half is
 the one row that fails it, which is the entire reason a delivery step exists.
 
+The store still holds those five keys, at `swarm/services/swarm-authelia/keys/<name>`,
+so that losing the host doesn't lose them. `authelia-swarm-secrets` in the container reads
+each with the secret publisher's identity and writes it to the file authelia loads. A store
+with no value takes the file's, so the key keeps its value; the unit mints a new key only when
+there is neither. Nothing rotates a key: the storage-encryption key encrypts authelia's
+database, and a new issuer key invalidates every token issued. A container without the
+publisher's identity generates the files as before.
+
 Three telemetry collectors exist, and each one fails that test: each reads its
 own secret out of the store, under its own identity.