swarm-controller: read the queue client secret from the store, drop the file

The controller's OIDC client secret (client `swarm-controller`, used for
the queue connection, the auth-bridge bearer and the OTLP push) came from
an operator-placed file, `deploy.swarm-controller.queue.clientSecretFile`,
handed in by `LoadCredential=`.

Now `swarm-secret-publish`, which already copies authelia's minted OIDC
secrets into the store, also publishes this one, to
`swarm/controller/swarm-controller/oidc/client`. That path sits under
`controller/`, which no hive's policy reads. The controller reads it once
at start with its existing store certificate and holds it in memory, as
`swarm_queue_client::ClientSecret::Value`. If the store is down, it
retries for about a minute and then fails the start, so `Restart=` tries
again.

Policy delta: the controller gets `read` on that leaf, and the publisher
gets `create`/`update` on that leaf.

Removed: the `queue.clientSecretFile` option (both spellings, now removed
options with a message), its singleHostSwarm default, the credential and
placeholder, and the path watcher plus its restart oneshot. A controller
without a store identity is now an eval error, because it has no other
way to get the secret.

nix/module-eval/core-toggle.nix

@@ -398,14 +398,14 @@ let
       # `? swarm-controller`: ./host-modules/hive-tls.nix defines an
       # environment key on that unit name, which leaves the attr
       # present-but-inert (no `ExecStart`, empty `wantedBy`) on every hive
-      # that has a CA — see the comment there. The credential oneshot has no
+      # that has a CA — see the comment there. The daemon's system user has no
       # second definer, so its absence is the unambiguous half.
       name = "the swarm controller does not run unless this host is told to run it";
       ok =
         let
           inert =
             machine:
-            !(machine.systemd.services ? swarm-controller-credential)
+            !(machine.users.users ? swarm-controller)
             && !(
               (machine.systemd.services.swarm-controller or { serviceConfig = { }; }).serviceConfig ? ExecStart
             );