swarm-controller: read the queue client secret from the store, drop the file

The controller's OIDC client secret (client `swarm-controller`, used for
the queue connection, the auth-bridge bearer and the OTLP push) came from
an operator-placed file, `deploy.swarm-controller.queue.clientSecretFile`,
handed in by `LoadCredential=`.

Now `swarm-secret-publish`, which already copies authelia's minted OIDC
secrets into the store, also publishes this one, to
`swarm/controller/swarm-controller/oidc/client`. That path sits under
`controller/`, which no hive's policy reads. The controller reads it once
at start with its existing store certificate and holds it in memory, as
`swarm_queue_client::ClientSecret::Value`. If the store is down, it
retries for about a minute and then fails the start, so `Restart=` tries
again.

Policy delta: the controller gets `read` on that leaf, and the publisher
gets `create`/`update` on that leaf.

Removed: the `queue.clientSecretFile` option (both spellings, now removed
options with a message), its singleHostSwarm default, the credential and
placeholder, and the path watcher plus its restart oneshot. A controller
without a store identity is now an eval error, because it has no other
way to get the secret.

swarm-controller/src/vcs_metrics.rs

@@ -138,7 +138,7 @@ fn build_provider(interval: Duration) -> Result<SdkMeterProvider> {
 /// Build the [`crate::otel_http_client::AuthenticatedHttpClient`] this
 /// exporter pushes through.
 ///
-/// The queue identity (`SWARM_CONTROLLER_OIDC_*`) is read fresh here rather
+/// The queue identity is read from [`crate::queue_identity::get`] rather
 /// than threaded in from a caller — by the time this runs, [`endpoint`] has
 /// already confirmed OTEL is configured for this host, and `queueEnv` is set
 /// **unconditionally** for every `swarm-controller` (the nix module's own
@@ -162,15 +162,13 @@ fn build_provider(interval: Duration) -> Result<SdkMeterProvider> {
 /// the same fact stated twice.
 pub(crate) fn authenticated_http_client() -> Result<crate::otel_http_client::AuthenticatedHttpClient>
 {
-    let cfg = swarm_queue_client::QueueConfig::from_env("SWARM_CONTROLLER")
-        .context("reading the queue identity this daemon authenticates its OTLP push with")?
-        .ok_or_else(|| {
-            anyhow::anyhow!(
-                "SWARM_CONTROLLER_NATS_URL and friends are unset, but OTEL_EXPORTER_OTLP_ENDPOINT \
+    let cfg = crate::queue_identity::get().cloned().ok_or_else(|| {
+        anyhow::anyhow!(
+            "SWARM_CONTROLLER_NATS_URL and friends are unset, but OTEL_EXPORTER_OTLP_ENDPOINT \
                  is — the queue is required for every controller, so this combination is a \
                  deployment bug, not a supported partial config"
-            )
-        })?;
+        )
+    })?;
     let audience = std::env::var("SWARM_CONTROLLER_OTEL_AUDIENCE").context(
         "SWARM_CONTROLLER_OTEL_AUDIENCE is unset, but OTEL_EXPORTER_OTLP_ENDPOINT is — the nix \
          module sets both together",