swarm-controller: read the queue client secret from the store, drop the file

The controller's OIDC client secret (client `swarm-controller`, used for
the queue connection, the auth-bridge bearer and the OTLP push) came from
an operator-placed file, `deploy.swarm-controller.queue.clientSecretFile`,
handed in by `LoadCredential=`.

Now `swarm-secret-publish`, which already copies authelia's minted OIDC
secrets into the store, also publishes this one, to
`swarm/controller/swarm-controller/oidc/client`. That path sits under
`controller/`, which no hive's policy reads. The controller reads it once
at start with its existing store certificate and holds it in memory, as
`swarm_queue_client::ClientSecret::Value`. If the store is down, it
retries for about a minute and then fails the start, so `Restart=` tries
again.

Policy delta: the controller gets `read` on that leaf, and the publisher
gets `create`/`update` on that leaf.

Removed: the `queue.clientSecretFile` option (both spellings, now removed
options with a message), its singleHostSwarm default, the credential and
placeholder, and the path watcher plus its restart oneshot. A controller
without a store identity is now an eval error, because it has no other
way to get the secret.

nix/host-modules/local-defaults.nix

@@ -127,15 +127,4 @@ in
   config.services.hyperhive.deploy.bao.bootstrapTokenFile = lib.mkIf cfg.deploy.singleHostSwarm (
     lib.mkDefault "/var/lib/swarm-bao-bootstrap/grant.token"
   );
-
-  # Same reason, one option later: the queue secret is a path on THIS host,
-  # so it moved to `deploy.*` with the rest of the controller's credentials.
-  # It has to sit out here rather than in the `swarm` attrset above — a bare
-  # `controller.` prefix in there means `swarm.controller`, which is now only
-  # a rename shim, so the definition would still resolve and warn on every
-  # evaluation of a single-host swarm.
-  config.services.hyperhive.deploy.swarm-controller.queue.clientSecretFile =
-    lib.mkIf cfg.deploy.singleHostSwarm (
-      lib.mkDefault "${config.services.hyperhive.deploy.authelia.hostClientSecretDir}/swarm-controller.secret"
-    );
 }