matrix: swarm-controller is the only minter

Every hive is in a swarm and every swarm runs matrix, so every swarm has a
swarm-controller, and since #4810 its hive_sender pass mints each hive's
@hive-<hive>: sender token into the store every five minutes. The two
other minters of that token go:

- swarm-matrix-ctl mint: the systemd.services.swarm-matrix-ctl unit in the
  hive-matrix container, Command::Mint and src/mint.rs. The binary, its
  appservice render/publish verbs, ctlPackage, ctlActive and the ctl cert
  role stay. bao-matrix-reader's checks on the deleted unit are removed;
  the leaf-identity and no-token-in-env checks now look at
  swarm-matrix-appservice-publish, which runs under the same identity.
- the hive-side mint ladder in hive-c0re's ensure_hive_user
  (register/appservice-login/password-login with the local as_token), with
  read_appservice_token, paths::matrix_appservice_token and the helpers
  only it used. ensure_hive_user now takes the store's token, keeps the
  file when the store has none or can't be reached, and fails otherwise.
- hivectl matrix sync-admin: the verb, HostRequest::MatrixSyncAdmin and
  handle_matrix_sync_admin. The periodic MatrixSweep (ensure_all) is
  unchanged apart from no longer reading the local as_token.

This removes the double-mint race #4810's review flagged: two minters
logging in on one pinned device could leave a dead token in the store
until the next pass.

Closes #4813
Closes #4814

hive-c0re/src/paths.rs

@@ -160,14 +160,6 @@ pub fn matrix_chat_room_id() -> PathBuf {
     matrix_dir().join("chat-room-id")
 }
 
-/// `matrix/creds/` — the hive sender account's throwaway matrix password
-/// (survives `destroy --purge`; it authenticates by token, this is
-/// recovery only).
-#[must_use]
-pub fn matrix_creds_dir() -> PathBuf {
-    matrix_dir().join("creds")
-}
-
 /// `run/` — runtime maps hive-c0re regenerates on every meta sync.
 #[must_use]
 pub fn run_dir() -> PathBuf {
@@ -284,17 +276,6 @@ pub fn gateway_agents_conf() -> PathBuf {
 //      `nix/host-modules/hive-c0re/default.nix` and `nix/host-modules/hive-ci.nix` — must match.
 pub const FORGE_CORE_TOKEN: &str = "/var/lib/hyperhive/forge-core-token";
 
-/// `matrix-appservice-token` — the `as_token` of the hive's appservice
-/// registration, which authorises every account this daemon creates.
-// nix: minted by the `hive-matrix-appservice` activation script in
-//      `nix/host-modules/hive-matrix.nix`, which renders it into the registration
-//      file the homeserver loads — must match. Read-only here on purpose: a token
-//      minted on this side would not be the one in that file.
-#[must_use]
-pub fn matrix_appservice_token() -> PathBuf {
-    state_root().join("matrix-appservice-token")
-}
-
 /// `/run/hyperhive` — the runtime root (host admin socket + per-agent dirs).
 #[must_use]
 pub fn runtime_root() -> PathBuf {
@@ -324,13 +305,12 @@ pub fn agent_runtime_dir(name: &str) -> PathBuf {
 /// within the same filesystem is atomic.
 pub fn relocate_legacy_state() {
     let root = state_root();
-    let moves: [(&str, PathBuf); 7] = [
+    let moves: [(&str, PathBuf); 6] = [
         ("broker.sqlite", db_dir().join("broker.sqlite")),
         ("build_logs.sqlite", db_dir().join("build_logs.sqlite")),
         ("forge-core-avatar-set", forge_core_avatar_marker()),
         ("matrix-sender-token", matrix_sender_token()),
         ("matrix-space-room-id", matrix_space_room_id()),
-        ("matrix-creds", matrix_creds_dir()),
         ("agent-sockets.json", agent_sockets_file()),
     ];
     for (old_rel, new) in &moves {