swarm-nats: give the queue a name, a bao-issued leaf, and require TLS

The queue listened in plaintext on 4222, reached by bridge IP or loopback,
and nothing in-tree opened it to another hive. It now has a name, serves a
certificate for that name alone, and refuses clients that do not speak TLS.

- `swarm.nats.domain`, default `nats.<swarm.domain>`, a sibling name like
  `swarm.bao.domain`. The queue host answers it via `gateway.localNames`;
  every other hive resolves it through the operator's DNS, as for bao.
- `pki/roles/swarm-nats` allows that one name (bare domain, no subdomains,
  IPs or localhost, server flag). A `swarm-nats` cert-auth role and policy
  may only `update` `pki/issue/swarm-nats`, written by
  `swarm-bao-nats-tls-policy`. The login leaf is minted by glue-bao-tls and
  paired by glue-nats-bao-identity. `deploy.bao.natsCommonName` is reserved
  as a hive name.
- `swarm-bao-nats-tls` issues the leaf into a directory bound read-only into
  the container, restarts nats when it rotates, and re-runs daily.
  It joins glue-bao-readers-policy-order, so it is ordered after its policy
  unit (`after` and `wants`, never `requires`) where the store is on the
  same host. The policy unit joins the store's journald list.
- nats gets `tls {}`, with the key via `LoadCredential`, and no
  `allow_non_tls`. `validateConfig` is now off in every mode, because the
  build-time check loads a leaf that only exists at runtime.
- 4222 is also open on `wg-hive` when the host is on the mesh, never
  host-wide.
- `statusPublish.natsUrl`, `queue.agentNatsUrl`, the controller's URL under
  `singleHostSwarm`, and the auth responder all dial
  `tls://<swarm.nats.domain>:<port>`. swarm-queue-client hands its CA file
  to the NATS connection too, so hive-c0re and the controller trust the
  leaf's root.
- docs/swarm/README.md: the queue URL and the one DNS record a multi-host
  swarm needs.

module-eval-nats-tls pins the role, the policy, the served leaf, the
firewall, the ordering, and a scan of every `*_NATS_URL` and the
responder's URL across the host and its containers.

Closes #4626

docs/swarm/README.md

@@ -343,11 +343,11 @@ half-configured hive is an eval error rather than one that quietly never
 reports. They sit in two namespaces, because two of them are facts about
 _this machine_ and one is the swarm's single address:
 
-| option                                                  | what to set it to                                      |
-| ------------------------------------------------------- | ------------------------------------------------------ |
-| `deploy.hive-controller.statusPublish.natsUrl`          | where the swarm queue listens, as this hive reaches it |
-| `swarm.statusPublish.tokenEndpoint`                     | the swarm IdP's `/api/oidc/token`                      |
-| `deploy.hive-controller.statusPublish.clientSecretFile` | path to this hive's client secret, plaintext           |
+| option                                                  | what to set it to                             |
+| ------------------------------------------------------- | --------------------------------------------- |
+| `deploy.hive-controller.statusPublish.natsUrl`          | `tls://<swarm.nats.domain>:<swarm.nats.port>` |
+| `swarm.statusPublish.tokenEndpoint`                     | the swarm IdP's `/api/oidc/token`             |
+| `deploy.hive-controller.statusPublish.clientSecretFile` | path to this hive's client secret, plaintext  |
 
 On a host that runs the queue and the IdP itself, all three default to
 the local ones and there is nothing to set. Any other hive needs them
@@ -356,6 +356,14 @@ not distribute it. Copy `hive-<hiveName>.secret` out of the swarm host's
 `deploy.authelia.hostClientSecretDir` with whatever secret management the
 deployment already uses.
 
+The queue URL is the same string on every hive. The queue accepts TLS only,
+with a certificate for `swarm.nats.domain` (default `nats.<swarm.domain>`) and
+no other name or address, so a URL with an IP address or `nats://` fails.
+The queue's host resolves the name itself. **A multi-host swarm needs one
+upstream DNS record**, `nats.<swarm.domain>` pointing at the queue host's mesh
+address, the same contract as `bao.<swarm.domain>`. The queue's port is open
+on `wg-hive` when that host is on the mesh.
+
 The identity isn't a choice — a hive authenticates as `hive-<hiveName>`
 and publishes under `hiveName`, the same name that keys `swarm.hives`.
 
@@ -382,12 +390,11 @@ with the credential itself and aren't configurable.
 | `deploy.hive-controller.queue.agentNatsUrl` | where the queue listens, as an agent **container** reaches it  |
 | `swarm.statusPublish.tokenEndpoint`         | the swarm IdP's `/api/oidc/token` — the same one the hive uses |
 
-On a host that runs the queue, `agentNatsUrl` defaults to
-`nats://<network.bridgeIp>:<swarm.nats.port>`, which is the only address that
-works from inside a container: the firewall opens the port on the bridge
-interface and nowhere else. ⚠️ **Never a loopback address here** — the hive's own
-`statusPublish.natsUrl` is loopback and correct, because `hive-c0re` shares the
-host's network namespace. An agent doesn't, so `127.0.0.1` reaches the agent.
+On a host that runs the queue, `agentNatsUrl` defaults to the same
+`tls://<swarm.nats.domain>:<swarm.nats.port>` as the hive's own. Inside a
+container the name resolves to the bridge address, where the firewall opens the
+port. ⚠️ **Never a loopback address here**: an agent has its own network
+namespace, so `127.0.0.1` reaches the agent.
 
 The harness sees four variables, and treats them as all-or-none:
 `HIVE_AGENT_NATS_URL` and `HIVE_AGENT_OIDC_TOKEN_ENDPOINT` from the two options