fix(#3401): let authelia re-read its user file on change

Authelia reads authentication_backend.file.path once at startup. Without
watch, an identity the bridge creates is real on disk and invisible to the
running authelia until something unrelated bounces the unit.

swarm-authelia-bridge cannot restart authelia -- running unprivileged
inside the container is the whole reason it may write that file, so
restarting the unit is exactly the privilege it was designed not to hold.
swarmctl does restart it, but that is a systemctl -M shellout that can
fail, and when it did the symptom was a login refused for a user whose
record was already correct on disk. This makes correctness stop depending
on that restart succeeding.

nix/host-modules/swarm-authelia.nix

@@ -967,7 +967,29 @@ in
               server.address = "tcp://127.0.0.1:${toString cfg.port}";
               log.level = "info";
 
-              authentication_backend.file.path = cfg.usersFile;
+              # Authelia reads this file once, at STARTUP. `watch` makes it
+              # re-read on change, and that is load-bearing rather than a
+              # convenience.
+              #
+              # `swarm-authelia-bridge` writes this file to create agent
+              # identities and **cannot** restart authelia: running
+              # unprivileged inside the container is the whole reason it is
+              # allowed to write the file at all, so "restart the unit" is
+              # exactly the privilege it was designed not to hold. Without
+              # `watch` every identity it creates is real on disk and
+              # invisible to the running authelia until something unrelated
+              # bounces the unit.
+              #
+              # `swarmctl` does restart authelia after writing — but that is
+              # a `systemctl -M` shellout that can fail, and when it did the
+              # symptom was a login refused for a user whose record was
+              # already correct on disk, with nothing implicating the
+              # reload. This setting is what makes correctness stop
+              # depending on that restart succeeding.
+              authentication_backend.file = {
+                path = cfg.usersFile;
+                watch = true;
+              };
 
               # ⚠️ `one_factor` as the DEFAULT means "any authenticated
               # user", which is authentication, not authorisation. The