swarm-controller: read the queue client secret from the store, drop the file

The controller's OIDC client secret (client `swarm-controller`, used for
the queue connection, the auth-bridge bearer and the OTLP push) came from
an operator-placed file, `deploy.swarm-controller.queue.clientSecretFile`,
handed in by `LoadCredential=`.

Now `swarm-secret-publish`, which already copies authelia's minted OIDC
secrets into the store, also publishes this one, to
`swarm/controller/swarm-controller/oidc/client`. That path sits under
`controller/`, which no hive's policy reads. The controller reads it once
at start with its existing store certificate and holds it in memory, as
`swarm_queue_client::ClientSecret::Value`. If the store is down, it
retries for about a minute and then fails the start, so `Restart=` tries
again.

Policy delta: the controller gets `read` on that leaf, and the publisher
gets `create`/`update` on that leaf.

Removed: the `queue.clientSecretFile` option (both spellings, now removed
options with a message), its singleHostSwarm default, the credential and
placeholder, and the path watcher plus its restart oneshot. A controller
without a store identity is now an eval error, because it has no other
way to get the secret.

nix/module-eval/bao-controller.nix

@@ -85,7 +85,21 @@ let
   baoWrapper = lib.findFirst (p: (p.name or "") == "bao-hive") null baoHostPackages;
 
   baoWrapperCmd = if baoWrapper == null then "" else (baoWrapper.buildCommand or "");
+
+  refusedWithoutIdentity =
+    m:
+    lib.any (
+      a: !a.assertion && lib.hasInfix "swarm-controller.baoClientCertFile and" a.message
+    ) m.assertions;
   cases = [
+    {
+      # The queue client secret lives only in the store, so a controller that
+      # cannot log in there cannot reach the queue. Refused at eval rather than
+      # left to start and never connect. The control is the co-located
+      # controller, which is handed the minted leaf and passes.
+      name = "a controller with no store identity is refused at eval, one given the minted leaf is not";
+      ok = refusedWithoutIdentity controllerNoStore && !(refusedWithoutIdentity baoControllerHere);
+    }
     {
       # No hive mints an agent's matrix account any more, so a controller that
       # did not know the homeserver would create every agent without one. The