matrix: swarm-controller is the only minter

Every hive is in a swarm and every swarm runs matrix, so every swarm has a
swarm-controller, and since #4810 its hive_sender pass mints each hive's
@hive-<hive>: sender token into the store every five minutes. The two
other minters of that token go:

- swarm-matrix-ctl mint: the systemd.services.swarm-matrix-ctl unit in the
  hive-matrix container, Command::Mint and src/mint.rs. The binary, its
  appservice render/publish verbs, ctlPackage, ctlActive and the ctl cert
  role stay. bao-matrix-reader's checks on the deleted unit are removed;
  the leaf-identity and no-token-in-env checks now look at
  swarm-matrix-appservice-publish, which runs under the same identity.
- the hive-side mint ladder in hive-c0re's ensure_hive_user
  (register/appservice-login/password-login with the local as_token), with
  read_appservice_token, paths::matrix_appservice_token and the helpers
  only it used. ensure_hive_user now takes the store's token, keeps the
  file when the store has none or can't be reached, and fails otherwise.
- hivectl matrix sync-admin: the verb, HostRequest::MatrixSyncAdmin and
  handle_matrix_sync_admin. The periodic MatrixSweep (ensure_all) is
  unchanged apart from no longer reading the local as_token.

This removes the double-mint race #4810's review flagged: two minters
logging in on one pinned device could leave a dead token in the store
until the next pass.

Closes #4813
Closes #4814

docs/tools/hivectl-cli.md

@@ -8,7 +8,6 @@ This document contains the help content for the `hivectl` command-line program.
 * [`hivectl forge`↴](#hivectl-forge)
 * [`hivectl forge reconcile-config`↴](#hivectl-forge-reconcile-config)
 * [`hivectl matrix`↴](#hivectl-matrix)
-* [`hivectl matrix sync-admin`↴](#hivectl-matrix-sync-admin)
 * [`hivectl matrix invite`↴](#hivectl-matrix-invite)
 * [`hivectl github`↴](#hivectl-github)
 * [`hivectl github set-token`↴](#hivectl-github-set-token)
@@ -64,7 +63,7 @@ Sibling to the `hive-c0re` daemon binary. Covers host-side admin operations that
 ###### **Subcommands:**
 
 * `forge` — Reconcile an agent's config between this hive and the forge
-* `matrix` — matrix-tuwunel user provisioning
+* `matrix` — matrix-tuwunel invites
 * `github` — GitHub account provisioning
 * `gateway` — Gateway htpasswd user management
 * `agent` — Lifecycle actions on ONE managed agent container. Needs the hive-c0re daemon running
@@ -129,29 +128,18 @@ Always prints the diff first. `--from forge` resets the local checkout to forge
 
 ## `hivectl matrix`
 
-matrix-tuwunel user provisioning.
+matrix-tuwunel invites.
 
-Manual entry point to the same idempotent provisioning c0re runs at boot — for re-registering an agent the boot sweep skipped, or after wiping a token file.
+Manual invites into the hive Space and its rooms; c0re's periodic matrix sweep provisions the Space, the chat room and the agents' invites on its own.
 
 **Usage:** `hivectl matrix <COMMAND>`
 
 ###### **Subcommands:**
 
-* `sync-admin` — Provision (or re-provision) the matrix appservice's sender account
 * `invite` — Invite a matrix user to the hive Space, or a specific room with `--room`. Idempotent
 
 
 
-## `hivectl matrix sync-admin`
-
-Provision (or re-provision) the matrix appservice's sender account.
-
-Runs automatically on startup; run manually to recover a missing access token.
-
-**Usage:** `hivectl matrix sync-admin`
-
-
-
 ## `hivectl matrix invite`
 
 Invite a matrix user to the hive Space, or a specific room with `--room`. Idempotent

docs/tools/hivectl.md

@@ -50,7 +50,6 @@ Manual entry to the same idempotent matrix provisioning flow
 running (`services.hyperhive.deploy.matrix.enable = true`).
 
 ```bash
-hivectl matrix sync-admin               # provision / refresh the appservice's sender account
 hivectl matrix invite mara              # invite a user to the hive Space
 hivectl matrix invite @mara:server --room '#hive-chat:server'  # ...or to a specific room/alias
 ```
@@ -59,10 +58,6 @@ Human matrix accounts come from SSO, not `hivectl`; matrix homeserver
 admin should eventually come from membership in authelia's `admins`
 group; nobody has built that sync yet.
 
-- `sync-admin`: ensures this hive's appservice sender account
-  (`@hive-<hive>:<server_name>`, one per hive) exists
-  (the account `hive-c0re` provisions rooms with). Token persisted to the
-  access token path. Safe to run again — idempotent.
 - `invite`: invites a matrix user (full `@user:server` or a bare
   localpart, qualified with the homeserver's `server_name`) to the hive
   Space by default, or to a `--room` id / `#alias`. Uses the sender