docs(swarm): add SWARM Mode page and cross-link from Deployment Modes
Comprehensive walkthrough for the newly-landed SWARM control plane:
- Architecture diagram (master: swarmctl/listener/ingester/api; worker:
agent/forwarder) with ports cheat sheet
- Step-by-step setup (CA bootstrap, enrollment, bundle shipment, agent +
forwarder startup, check, first swarm deploy)
- Full command reference for swarmctl, listener, agent, forwarder, and
the swarm enroll/list/check/decommission subcommands
- Log-pipeline end-to-end story (RFC 5424 on worker → RFC 5425 mTLS on
6514 → master.json → ingester → dashboard), including tcpdump-based
plaintext-leak check and source_worker provenance note
- Operational concerns: master crash resume (no dup/loss), worker crash,
CA rotation, cert rotation, teardown
- Security posture summary
- Known limitations (get_host_ip master-side bug, no web UI yet,
round-robin only, single master)
- Troubleshooting matrix
Deployment-Modes: trimmed the old 'swarm is not implemented, drive it
from Ansible' section and replaced with a link to the new page.
_Sidebar: added SWARM-Mode under User docs.
