docs: suppress reviewed write-good.Passive false positives

133 hits across 38 files, all previously classified during #4548's sweep
and deliberately left un-rewritten (predicate-adjective state/necessity
description, design-intent idiom, structural/type-description idiom,
no-single-actor topology claim, parallel-triple exception, vale
substring-match artifact — see hyperhive#4548's per-PR bodies for the
per-hit reasoning).

Wraps each one in a scoped <!-- vale write-good.Passive = NO/YES -->
pair (the supported mechanism — TokenIgnores has a known offset-drift
bug) rather than a blanket per-file or per-rule silence, so a *new*
passive-voice hit anywhere in these files still fails once the rule
gates CI (next commit). Table/list false positives (docs/swarm/credentials.md's
renewal-table cells) wrap the whole block, not each cell.

Part of #4546.

docs/swarm/services.md

@@ -118,12 +118,16 @@ See `retentionPeriod` below before leaving it at its default.
 | `swarm.grafana.oidc.role`                | Default `Admin` for everyone who logs in. Lower to `Viewer`/`Editor` if the swarm grows operators who shouldn't be able to reconfigure Grafana.                                                |
 | `deploy.grafana.datasourceUrl`           | Only if you front VictoriaMetrics with something else. It defaults to the store on this host, which is the only thing it can reach.                                                            |
 
+<!-- vale write-good.Passive = NO -->
+
 **Logging in.** Grafana is behind swarm SSO, so the accounts are the
 authelia ones — there is no separate Grafana password, and this module
 switches off the local login form whenever SSO is configured. If you enable
 Grafana on a host with no authelia, the form stays on and Grafana's
 default `admin`/`admin` applies; change it before exposing that host.
 
+<!-- vale write-good.Passive = YES -->
+
 **Where the data comes from.** The swarm's OTEL collector, below.
 
 Neither container is reachable except through the gateway: both bind