hive status publishing: read the hive's OIDC secret from the store, retry until it is there

hive-c0re publishes this hive's status to the swarm queue as the OIDC
client `hive-<name>`. Its secret came from
`deploy.hive-controller.statusPublish.clientSecretFile`, which defaulted
to authelia's minted file only on a host running both authelia and the
queue. Every other hive had no secret and never published, so the
controller showed it `never_reported`.

Now `swarm-secret-publish`, beside authelia, also copies each hive's
`hive-<name>` secret to `swarm/hives/<hive>/oidc/client`. Its policy
already allows `swarm/hives/*`. hive-c0re reads that path under the
hive's own store leaf, which the existing `swarm/hives/<hive>/*` grant
covers, and holds the value in memory.

The shared queue client no longer remembers a failed first connect for
the life of the process. A failed attempt is retried with a backoff
from 5s, doubling to a cap of 5 minutes; the dashboard banner stays up
until an attempt succeeds. The two status publishers wait for the
client instead of giving up on the first `None`, so a secret published
after boot is picked up without a restart.

Removed: the `statusPublish.clientSecretFile` option (both spellings,
now removed options with a message), its same-host default, its
LoadCredential, the assertion tying it to the other two coordinates,
and `swarm_queue_client::QueueConfig::from_env`, whose only caller was
this read. Publishing is now on wherever the queue URL and token
endpoint are set and the hive holds a store leaf.

Refs #5015

nix/host-modules/deploy.nix

@@ -32,6 +32,14 @@
 let
   deployCfg = config.services.hyperhive.deploy;
 
+  # Shared by the two removed spellings of the status-publishing secret below.
+  statusSecretRemoved = ''
+    hive-c0re reads this hive's status-publishing client secret from the
+    swarm's secret store, under the hive's own certificate
+    (deploy.bao.clientCertFile), and swarm-secret-publish on the host that runs
+    authelia puts it there. Remove this definition; the file it named is read
+    by nothing now and can be deleted.
+  '';
 in
 {
   imports = [
@@ -115,19 +123,28 @@ in
       [ "services" "hyperhive" "swarm" "nats" "enable" ]
       [ "services" "hyperhive" "deploy" "nats" "enable" ]
     )
-    # Two of statusPublish's three coordinates. `tokenEndpoint` stays under
-    # `swarm.*`: it is the swarm IdP's one address, identical on every hive,
-    # where these two are "the queue as seen from here" and "the secret on
-    # this disk". The all-or-nothing assertion in ./swarm.nix spans the split
-    # deliberately and names all three paths in its message.
+    # `tokenEndpoint` stays under `swarm.*`: it is the swarm IdP's one
+    # address, identical on every hive, where this is "the queue as seen from
+    # here".
     (lib.mkRenamedOptionModule
       [ "services" "hyperhive" "swarm" "statusPublish" "natsUrl" ]
       [ "services" "hyperhive" "deploy" "hive-controller" "statusPublish" "natsUrl" ]
     )
-    (lib.mkRenamedOptionModule
-      [ "services" "hyperhive" "swarm" "statusPublish" "clientSecretFile" ]
-      [ "services" "hyperhive" "deploy" "hive-controller" "statusPublish" "clientSecretFile" ]
-    )
+    (lib.mkRemovedOptionModule [
+      "services"
+      "hyperhive"
+      "swarm"
+      "statusPublish"
+      "clientSecretFile"
+    ] statusSecretRemoved)
+    (lib.mkRemovedOptionModule [
+      "services"
+      "hyperhive"
+      "deploy"
+      "hive-controller"
+      "statusPublish"
+      "clientSecretFile"
+    ] statusSecretRemoved)
     # Both old spellings of "run a hive here" forward to the one switch.
     (lib.mkRenamedOptionModule
       [ "services" "hyperhive" "enable" ]