swarm-nats: give the queue a name, a bao-issued leaf, and require TLS

The queue listened in plaintext on 4222, reached by bridge IP or loopback,
and nothing in-tree opened it to another hive. It now has a name, serves a
certificate for that name alone, and refuses clients that do not speak TLS.

- `swarm.nats.domain`, default `nats.<swarm.domain>`, a sibling name like
  `swarm.bao.domain`. The queue host answers it via `gateway.localNames`;
  every other hive resolves it through the operator's DNS, as for bao.
- `pki/roles/swarm-nats` allows that one name (bare domain, no subdomains,
  IPs or localhost, server flag). A `swarm-nats` cert-auth role and policy
  may only `update` `pki/issue/swarm-nats`, written by
  `swarm-bao-nats-tls-policy`. The login leaf is minted by glue-bao-tls and
  paired by glue-nats-bao-identity. `deploy.bao.natsCommonName` is reserved
  as a hive name.
- `swarm-bao-nats-tls` issues the leaf into a directory bound read-only into
  the container, restarts nats when it rotates, and re-runs daily.
  It joins glue-bao-readers-policy-order, so it is ordered after its policy
  unit (`after` and `wants`, never `requires`) where the store is on the
  same host. The policy unit joins the store's journald list.
- nats gets `tls {}`, with the key via `LoadCredential`, and no
  `allow_non_tls`. `validateConfig` is now off in every mode, because the
  build-time check loads a leaf that only exists at runtime.
- 4222 is also open on `wg-hive` when the host is on the mesh, never
  host-wide.
- `statusPublish.natsUrl`, `queue.agentNatsUrl`, the controller's URL under
  `singleHostSwarm`, and the auth responder all dial
  `tls://<swarm.nats.domain>:<port>`. swarm-queue-client hands its CA file
  to the NATS connection too, so hive-c0re and the controller trust the
  leaf's root.
- docs/swarm/README.md: the queue URL and the one DNS record a multi-host
  swarm needs.

module-eval-nats-tls pins the role, the policy, the served leaf, the
firewall, the ordering, and a scan of every `*_NATS_URL` and the
responder's URL across the host and its containers.

Closes #4626

nix/host-modules/swarm-controller.nix

@@ -365,18 +365,17 @@ in
       natsUrl = lib.mkOption {
         type = lib.types.str;
         default = "";
-        example = "nats://queue.example.com:4222";
+        example = "tls://nats.example.com:4222";
         description = ''
           Where the controller reaches the swarm queue.
 
           Empty means unset, which the assertion below refuses — a
           controller with no queue is not a lighter controller.
 
-          `singleHostSwarm` fills this in with loopback, because
-          that address is only correct when the queue is on this host:
-          its container shares the host netns. That derivation lives with
-          the mode rather than here, so this option describes itself
-          rather than a deployment shape.
+          `singleHostSwarm` fills this in with
+          `tls://<swarm.nats.domain>:<port>`. That derivation lives with the
+          mode rather than here, so this option describes itself rather than
+          a deployment shape.
         '';
       };
 
@@ -765,9 +764,8 @@ in
         message = ''
           services.hyperhive.swarm.controller.queue.natsUrl is unset.
 
-          It defaults to loopback only when this host also runs the queue
-          (`services.hyperhive.deploy.nats.enable`). A controller on its
-          own host has to be told where the queue is.
+          `singleHostSwarm` fills it in with the queue's name. A controller
+          in any other deployment has to be told the URL.
         '';
       }
       {