docs: fold swarm/secrets.md into the credentials reference

secrets.md and credentials-reference.md answered the same question from two
pages. secrets.md's text now follows the reference's table and operating
notes as a 'Where each secret lives' section, unchanged apart from where it
sits. Every link and doc path that named secrets.md (docs, nix comments,
crate READMEs) points at credentials-reference.md; anchors are unchanged.

docs/swarm/README.md

@@ -41,11 +41,11 @@ grafana, the controller, authelia, …) →
   stack, each on whichever host you put it. → [`services.md`](services.md)
 - **SSO** — the secrets authelia generates and how each reaches its reader.
   → [`sso.md`](sso.md)
-- **secrets** — every credential the swarm holds, who mints it and where it
-  lives → [`secrets.md`](secrets.md) · the per-secret minter/reader/renewal
-  contract → [`credentials.md`](credentials.md), per credential in
-  [`credentials-reference.md`](credentials-reference.md) · how the store comes up,
-  who writes its grants and how it unseals → [`bao.md`](bao.md)
+- **secrets** — the rules a credential follows → [`credentials.md`](credentials.md);
+  every credential the swarm holds, who mints it, who reads it, how it renews
+  and where it lives → [`credentials-reference.md`](credentials-reference.md) ·
+  how the store comes up, who writes its grants and how it unseals →
+  [`bao.md`](bao.md)
 - **swarm CA** — the store root every hive's gateway leaf chains to, and what to
   hand a peer. → [`ca.md`](ca.md)
 - **snapshot store** — the swarm's one `btrfs receive` endpoint,