matrix: swarm-controller is the only minter

Every hive is in a swarm and every swarm runs matrix, so every swarm has a
swarm-controller, and since #4810 its hive_sender pass mints each hive's
@hive-<hive>: sender token into the store every five minutes. The two
other minters of that token go:

- swarm-matrix-ctl mint: the systemd.services.swarm-matrix-ctl unit in the
  hive-matrix container, Command::Mint and src/mint.rs. The binary, its
  appservice render/publish verbs, ctlPackage, ctlActive and the ctl cert
  role stay. bao-matrix-reader's checks on the deleted unit are removed;
  the leaf-identity and no-token-in-env checks now look at
  swarm-matrix-appservice-publish, which runs under the same identity.
- the hive-side mint ladder in hive-c0re's ensure_hive_user
  (register/appservice-login/password-login with the local as_token), with
  read_appservice_token, paths::matrix_appservice_token and the helpers
  only it used. ensure_hive_user now takes the store's token, keeps the
  file when the store has none or can't be reached, and fails otherwise.
- hivectl matrix sync-admin: the verb, HostRequest::MatrixSyncAdmin and
  handle_matrix_sync_admin. The periodic MatrixSweep (ensure_all) is
  unchanged apart from no longer reading the local as_token.

This removes the double-mint race #4810's review flagged: two minters
logging in on one pinned device could leave a dead token in the store
until the next pass.

Closes #4813
Closes #4814

docs/tools/hivectl.md

@@ -50,7 +50,6 @@ Manual entry to the same idempotent matrix provisioning flow
 running (`services.hyperhive.deploy.matrix.enable = true`).
 
 ```bash
-hivectl matrix sync-admin               # provision / refresh the appservice's sender account
 hivectl matrix invite mara              # invite a user to the hive Space
 hivectl matrix invite @mara:server --room '#hive-chat:server'  # ...or to a specific room/alias
 ```
@@ -59,10 +58,6 @@ Human matrix accounts come from SSO, not `hivectl`; matrix homeserver
 admin should eventually come from membership in authelia's `admins`
 group; nobody has built that sync yet.
 
-- `sync-admin`: ensures this hive's appservice sender account
-  (`@hive-<hive>:<server_name>`, one per hive) exists
-  (the account `hive-c0re` provisions rooms with). Token persisted to the
-  access token path. Safe to run again — idempotent.
 - `invite`: invites a matrix user (full `@user:server` or a bare
   localpart, qualified with the homeserver's `server_name`) to the hive
   Space by default, or to a `--room` id / `#alias`. Uses the sender