glue-matrix-bao-token: the store's first reader

Fetches an opaque 32-byte value and writes it where hive-matrix.nix
already looks, so the homeserver never learns the store exists.

Chosen over authelia's OIDC secret deliberately: that one needs a
.secret AND a matching .digest, so shipping it first would debug 'can a
reader authenticate and get bytes back' and 'did we write authelia's
file format right' at once, with an SSO outage as the failure mode. Here
the failure is narrow -- new agent accounts cannot be provisioned,
existing ones untouched.

Every failure path keeps the local token: no such key, sealed store,
unreachable store, empty value. The activation script's mint-if-absent
is untouched, so a hive with no store behaves exactly as it does today.

matrixMachine is a literal because hive-matrix.nix declares no `machine`
option -- `matrixCfg.machine` parses cleanly and fails at module-system
resolution, which is the kind of error only reading the target module
catches.

nix/host-modules/default.nix

@@ -24,6 +24,7 @@
     ./hive-tls.nix
     ./otel.nix
     ./glue-bao-tls.nix
+    ./glue-matrix-bao-token.nix
     ./swarm-authelia.nix
     ./swarm-bao.nix
     ./swarm-ca.nix