nix: move the reader-after-policy edges into their own colocation glue

The four readers' ordering after their policy units only applies where
the store and that reader share a host, so it is colocation glue and
does not belong in the reader modules (two of which are main modules).
glue-bao-readers-policy-order.nix now sets the after+wants edges, gated
on deploy.bao.enable AND the reader's own gate, so a store host without
a reader gains no stub unit.

nix/host-modules/glue-bao-readers-policy-order.nix

@@ -0,0 +1,60 @@
+# Glue: where the store and one of its readers share a host, the reader waits
+# for the unit that writes the cert-auth role it logs in with.
+#
+# ONE PAIRING PER FILE — the store's four reader policy units ← the readers
+# they grant, and nothing else. Deleting this leaves every reader as it is on a
+# host whose store is remote: it may log in before its role exists, and its own
+# retries are what carry it past that.
+#
+# ⚠️ Gated on BOTH the store and that reader being here. Off the store's host
+# there is no local policy unit to order against. On the store's host without
+# the reader, setting `systemd.services.<reader>.after` would define a unit
+# with no ExecStart, so each gate below restates the one the reader's own
+# module puts on it. A reader whose gate changes must change here too.
+#
+# Ordering, never a requirement: a policy unit skips once the bootstrap token
+# is gone, and a skipped unit counts as done. `wants` as well as `after`, so a
+# reader started on its own pulls its policy unit into the same transaction.
+{
+  lib,
+  config,
+  ...
+}:
+let
+  hyperhiveCfg = config.services.hyperhive;
+  deployCfg = hyperhiveCfg.deploy;
+  baoDeploy = deployCfg.bao;
+
+  havePair = cert: key: cert != null && key != null;
+
+  # Reader unit → the gate its own module defines it under.
+  readersHere = {
+    # ./glue-matrix-bao-token.nix
+    swarm-bao-matrix-token =
+      hyperhiveCfg.enable
+      && havePair baoDeploy.matrixTokenClientCertFile baoDeploy.matrixTokenClientKeyFile
+      && deployCfg.matrix.enable;
+    # ./glue-queue-agent-credential.nix
+    swarm-bao-queue-agent =
+      hyperhiveCfg.enable
+      && havePair baoDeploy.queueAgentClientCertFile baoDeploy.queueAgentClientKeyFile;
+    # ./swarm-grafana.nix
+    swarm-bao-grafana-oidc = hyperhiveCfg.enable && deployCfg.grafana.enable;
+    # ./swarm-otel.nix
+    swarm-bao-otel-oidc =
+      deployCfg.swarm-otel.enable
+      && havePair baoDeploy.otelOidcClientCertFile baoDeploy.otelOidcClientKeyFile;
+  };
+
+  orderAfterPolicy =
+    reader: here:
+    lib.mkIf (baoDeploy.enable && here) {
+      systemd.services.${reader} = {
+        after = [ "${reader}-policy.service" ];
+        wants = [ "${reader}-policy.service" ];
+      };
+    };
+in
+{
+  config = lib.mkMerge (lib.mapAttrsToList orderAfterPolicy readersHere);
+}