swarm-bao: the agent-token checkers' cert roles issue batch tokens

nix/host-modules/swarm-bao.nix

@@ -1001,6 +1001,7 @@ let
     {
       name = "swarm-nats-auth";
       cn = baoDeploy.natsAuthCommonName;
+      batchToken = true;
       policyText =
         readStanza "${credentialMountPath}/data/swarm/agents/+/queue"
         + readStanza "${credentialMountPath}/data/swarm/services/${hyperhiveCfg.swarm.nats.clientId}/oidc/client"
@@ -1052,6 +1053,7 @@ let
     {
       name = "swarm-logs-auth";
       cn = baoDeploy.logsAuthCommonName;
+      batchToken = true;
       policyText =
         readStanza "${credentialMountPath}/data/swarm/agents/+/queue"
         + readStanza "${credentialMountPath}/data/${grafanaMetricsBearerLeaf}"
@@ -1069,6 +1071,7 @@ let
     {
       name = "swarm-metrics-auth";
       cn = baoDeploy.metricsAuthCommonName;
+      batchToken = true;
       policyText =
         readStanza "${credentialMountPath}/data/swarm/agents/+/queue"
         + readStanza "${credentialMountPath}/data/${grafanaMetricsBearerLeaf}"
@@ -1182,13 +1185,25 @@ let
   # `swarm` in one — and ./swarm.nix reserves the concrete per-hive spellings
   # anyway, because the prefixes are operator-settable and an operator may spell
   # one without that substring.
-  readerRoleWrite = obj: ''
-    bao write auth/cert/certs/${lib.escapeShellArg obj.name} \
-      certificate=@${tlsDir}/client-ca.pem \
-      allowed_common_names=${lib.escapeShellArg obj.cn} \
-      token_policies=${lib.escapeShellArg obj.name} \
-      display_name=${lib.escapeShellArg obj.cn}
-  '';
+  #
+  # `batchToken = true` on an object makes its logins batch tokens, which the
+  # store does not persist and cannot renew or revoke. Only for a principal
+  # that logs in, reads and drops the token within one call: the five
+  # minutes outlast that read, and a leaked token dies as fast. A principal
+  # that holds a handle longer must not set it.
+  readerRoleWrite =
+    obj:
+    let
+      batchArgs = lib.optionalString (obj.batchToken or false
+      ) " \\\n  token_type=batch \\\n  token_ttl=5m";
+    in
+    ''
+      bao write auth/cert/certs/${lib.escapeShellArg obj.name} \
+        certificate=@${tlsDir}/client-ca.pem \
+        allowed_common_names=${lib.escapeShellArg obj.cn} \
+        token_policies=${lib.escapeShellArg obj.name} \
+        display_name=${lib.escapeShellArg obj.cn}${batchArgs}
+    '';
 
   # A unit that logs in as the granter and runs `body`, ordered after the
   # controller's unit. `after` and not `requires`: the controller's and the