swarm-controller: read the queue client secret from the store, drop the file

The controller's OIDC client secret (client `swarm-controller`, used for
the queue connection, the auth-bridge bearer and the OTLP push) came from
an operator-placed file, `deploy.swarm-controller.queue.clientSecretFile`,
handed in by `LoadCredential=`.

Now `swarm-secret-publish`, which already copies authelia's minted OIDC
secrets into the store, also publishes this one, to
`swarm/controller/swarm-controller/oidc/client`. That path sits under
`controller/`, which no hive's policy reads. The controller reads it once
at start with its existing store certificate and holds it in memory, as
`swarm_queue_client::ClientSecret::Value`. If the store is down, it
retries for about a minute and then fails the start, so `Restart=` tries
again.

Policy delta: the controller gets `read` on that leaf, and the publisher
gets `create`/`update` on that leaf.

Removed: the `queue.clientSecretFile` option (both spellings, now removed
options with a message), its singleHostSwarm default, the credential and
placeholder, and the path watcher plus its restart oneshot. A controller
without a store identity is now an eval error, because it has no other
way to get the secret.

swarm-queue-client/README.md

@@ -43,10 +43,13 @@ environment is a hard error, because the failure it would otherwise produce is
 the expensive kind — the process comes up "fine", never connects, and the data
 it was supposed to move silently stops.
 
-The client secret is a **path, not a value**: putting it in the environment
-would publish it to anything that can read `/proc/<pid>/environ`. It is read
-per token request rather than cached, so a rotation the operator believes took
-effect actually did.
+The client secret is never in the environment, which would publish it to
+anything that can read `/proc/<pid>/environ`. `from_env` takes it as a
+**path** (`ClientSecret::File`), read per token request rather than cached, so
+a rotation the operator believes took effect actually did. A caller that
+fetched the secret from somewhere else builds the config itself with
+`ClientSecret::Value`, held in memory; `swarm-controller` does this with the
+secret it reads from the swarm's secret store.
 
 ## Token request shape: HTTP Basic, `audience`, `scope`