matrix: swarm-controller is the only minter

Every hive is in a swarm and every swarm runs matrix, so every swarm has a
swarm-controller, and since #4810 its hive_sender pass mints each hive's
@hive-<hive>: sender token into the store every five minutes. The two
other minters of that token go:

- swarm-matrix-ctl mint: the systemd.services.swarm-matrix-ctl unit in the
  hive-matrix container, Command::Mint and src/mint.rs. The binary, its
  appservice render/publish verbs, ctlPackage, ctlActive and the ctl cert
  role stay. bao-matrix-reader's checks on the deleted unit are removed;
  the leaf-identity and no-token-in-env checks now look at
  swarm-matrix-appservice-publish, which runs under the same identity.
- the hive-side mint ladder in hive-c0re's ensure_hive_user
  (register/appservice-login/password-login with the local as_token), with
  read_appservice_token, paths::matrix_appservice_token and the helpers
  only it used. ensure_hive_user now takes the store's token, keeps the
  file when the store has none or can't be reached, and fails otherwise.
- hivectl matrix sync-admin: the verb, HostRequest::MatrixSyncAdmin and
  handle_matrix_sync_admin. The periodic MatrixSweep (ensure_all) is
  unchanged apart from no longer reading the local as_token.

This removes the double-mint race #4810's review flagged: two minters
logging in on one pinned device could leave a dead token in the store
until the next pass.

Closes #4813
Closes #4814

hive-host-sock/src/lib.rs

@@ -270,9 +270,6 @@ pub enum HostRequest {
         #[serde(default)]
         scope: LifecycleScope,
     },
-    /// Provision (or re-provision) the hive system admin matrix account.
-    /// Daemon-side equivalent of `hivectl matrix sync-admin`.
-    MatrixSyncAdmin,
     /// Invite a matrix user to the hive Space (default) or a specific
     /// `room`. Uses the daemon's admin token; idempotent
     /// (already-member / already-invited is a no-op).
@@ -539,8 +536,7 @@ pub struct HostResponse {
     pub nodes: Option<Vec<hive_jobq_wire::GraphNode>>,
     /// Free-form operator-facing output lines the client prints verbatim
     /// (one per line). Carries results a request produced daemon-side that
-    /// have no structured home — e.g. the sender token path from
-    /// `MatrixSyncAdmin`, or the invited room id from `MatrixInvite`.
+    /// have no structured home — e.g. the invited room id from `MatrixInvite`.
     /// Empty for requests that produce no such output.
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub messages: Vec<String>,