keep authelia's oidc client secrets in the store, not on disk

The mint creates each client's secret in the swarm secret store and writes only the digest to disk. It mints only when the store answers and holds none. A new unit moves the plaintext files an earlier release left into the store and removes each once the store holds the same value. The bridge reads its secret from the store into /run before each start. The secret publisher unit and its path unit are gone.

hive-c0re/src/swarm_queue.rs

@@ -14,7 +14,7 @@
 //! environment. The client secret comes from the swarm's secret store, at
 //! `swarm_secret_client::queue::hive_client_path`, read under this hive's own
 //! certificate, held only in memory and read again when authelia refuses it
-//! (`swarm_secret_client::stored_secret`). `swarm-secret-publish`, in authelia's
+//! (`swarm_secret_client::stored_secret`). authelia's mint (`authelia-swarm-secrets`), in its
 //! container, puts it there.
 //!
 //! Connects lazily on first use rather than at boot — nothing here
@@ -290,8 +290,8 @@ async fn fetch_secret() -> Result<String> {
     match stored {
         Some(c) if !c.value.trim().is_empty() => Ok(c.value.trim().to_owned()),
         _ => bail!(
-            "nothing at {path}: swarm-secret-publish, in authelia's container, has not \
-             published this hive's client secret"
+            "nothing at {path}: authelia's mint, in its container, has not \
+             stored this hive's client secret"
         ),
     }
 }