swarm-nats: take the callout issuer and user keys from the store

`swarm-bao-nats-callout-xkey` runs `ensure-callout-keys`, importing
/var/lib/swarm-nats-callout/{issuer,callout-user}.seed when present so the
keys keep their public halves, then fetches all three public halves from
the store. The verb removes each seed file once a read of the store returns
a seed; when the store's seed differs, it is kept and a warning names the
file. No tmpfiles rule touches those files, since one could run before the
import with the store sealed and leave the next run to mint a new key.

The server renders the issuer and user public halves from the fetched files,
checked for shape as the xkey's is, and does not start without them. The
responder reads both seeds from the store, so the copies into the container
and their LoadCredential entries are gone, and a tmpfiles rule removes the
copies a container still holds. `swarm-nats-callout-keys` is removed.

On the store's host the fetch unit is also ordered after
`swarm-bao-secret-publisher-policy`, so the publisher's denial of the seed
paths is written before the unit creates or keeps a seed there.

`deploy.nats.autoGenerateCallout`, `calloutUserPublicKey`,
`calloutIssuerPublicKey`, `calloutUserSeedFile` and `calloutIssuerSeedFile`
are removed with `mkRemovedOptionModule`, under `swarm.nats` too, each
message saying the keys live in the store.

nix/host-modules/local-defaults.nix

@@ -74,14 +74,6 @@ in
   # services" is a per-host decision.
   config.services.hyperhive.deploy.allSwarmServices = lib.mkDefault cfg.deploy.singleHostSwarm;
 
-  # The queue's auth-callout nkeys. Generating them is safe exactly
-  # when one operator owns both the queue and its responder, which is
-  # what this mode asserts. On any other topology the seeds have to
-  # reach whoever runs the responder, and minting them here would move
-  # that hand-off somewhere less visible rather than removing it.
-  config.services.hyperhive.deploy.nats.autoGenerateCallout =
-    lib.mkDefault cfg.deploy.singleHostSwarm;
-
   # The controller is asserted by the MODE and by nothing else. Its own
   # option stays `default = false` precisely because running it is a
   # statement about swarm topology — but "this box is the whole