swarm-nats: give the queue a name, a bao-issued leaf, and require TLS

The queue listened in plaintext on 4222, reached by bridge IP or loopback,
and nothing in-tree opened it to another hive. It now has a name, serves a
certificate for that name alone, and refuses clients that do not speak TLS.

- `swarm.nats.domain`, default `nats.<swarm.domain>`, a sibling name like
  `swarm.bao.domain`. The queue host answers it via `gateway.localNames`;
  every other hive resolves it through the operator's DNS, as for bao.
- `pki/roles/swarm-nats` allows that one name (bare domain, no subdomains,
  IPs or localhost, server flag). A `swarm-nats` cert-auth role and policy
  may only `update` `pki/issue/swarm-nats`, written by
  `swarm-bao-nats-tls-policy`. The login leaf is minted by glue-bao-tls and
  paired by glue-nats-bao-identity. `deploy.bao.natsCommonName` is reserved
  as a hive name.
- `swarm-bao-nats-tls` issues the leaf into a directory bound read-only into
  the container, restarts nats when it rotates, and re-runs daily.
  It joins glue-bao-readers-policy-order, so it is ordered after its policy
  unit (`after` and `wants`, never `requires`) where the store is on the
  same host. The policy unit joins the store's journald list.
- nats gets `tls {}`, with the key via `LoadCredential`, and no
  `allow_non_tls`. `validateConfig` is now off in every mode, because the
  build-time check loads a leaf that only exists at runtime.
- 4222 is also open on `wg-hive` when the host is on the mesh, never
  host-wide.
- `statusPublish.natsUrl`, `queue.agentNatsUrl`, the controller's URL under
  `singleHostSwarm`, and the auth responder all dial
  `tls://<swarm.nats.domain>:<port>`. swarm-queue-client hands its CA file
  to the NATS connection too, so hive-c0re and the controller trust the
  leaf's root.
- docs/swarm/README.md: the queue URL and the one DNS record a multi-host
  swarm needs.

module-eval-nats-tls pins the role, the policy, the served leaf, the
firewall, the ordering, and a scan of every `*_NATS_URL` and the
responder's URL across the host and its containers.

Closes #4626

nix/host-modules/local-defaults.nix

@@ -88,11 +88,10 @@ in
 
   config.services.hyperhive.swarm = {
     ca.autoConfigure = lib.mkDefault cfg.deploy.singleHostSwarm;
-    # The controller's queue coordinates. Co-location is what makes these
-    # derivable at all — loopback only reaches the queue when the queue is
-    # here, and the minted client secret only exists on the host authelia
-    # ran its first boot on — so they belong to the mode that asserts this
-    # box is the whole deployment, not to the options' own `default`.
+    # The controller's queue coordinates. Kept with the mode, not in the
+    # options' own `default`, because the controller's minted client secret
+    # only exists on the host authelia ran its first boot on — so they belong
+    # to the mode that asserts this box is the whole deployment.
     #
     # Deriving them from `deploy.nats` / `deploy.authelia`
     # inside those defaults is the mixing this file exists to prevent: the
@@ -110,7 +109,7 @@ in
     # needing a queue is the controller's own property in every topology,
     # and only the convenience is local.
     controller.queue.natsUrl = lib.mkIf cfg.deploy.singleHostSwarm (
-      lib.mkDefault "nats://127.0.0.1:${toString config.services.hyperhive.swarm.nats.port}"
+      lib.mkDefault "tls://${config.services.hyperhive.swarm.nats.domain}:${toString config.services.hyperhive.swarm.nats.port}"
     );
   };