swarm-nats: give the queue a name, a bao-issued leaf, and require TLS

The queue listened in plaintext on 4222, reached by bridge IP or loopback,
and nothing in-tree opened it to another hive. It now has a name, serves a
certificate for that name alone, and refuses clients that do not speak TLS.

- `swarm.nats.domain`, default `nats.<swarm.domain>`, a sibling name like
  `swarm.bao.domain`. The queue host answers it via `gateway.localNames`;
  every other hive resolves it through the operator's DNS, as for bao.
- `pki/roles/swarm-nats` allows that one name (bare domain, no subdomains,
  IPs or localhost, server flag). A `swarm-nats` cert-auth role and policy
  may only `update` `pki/issue/swarm-nats`, written by
  `swarm-bao-nats-tls-policy`. The login leaf is minted by glue-bao-tls and
  paired by glue-nats-bao-identity. `deploy.bao.natsCommonName` is reserved
  as a hive name.
- `swarm-bao-nats-tls` issues the leaf into a directory bound read-only into
  the container, restarts nats when it rotates, and re-runs daily.
  It joins glue-bao-readers-policy-order, so it is ordered after its policy
  unit (`after` and `wants`, never `requires`) where the store is on the
  same host. The policy unit joins the store's journald list.
- nats gets `tls {}`, with the key via `LoadCredential`, and no
  `allow_non_tls`. `validateConfig` is now off in every mode, because the
  build-time check loads a leaf that only exists at runtime.
- 4222 is also open on `wg-hive` when the host is on the mesh, never
  host-wide.
- `statusPublish.natsUrl`, `queue.agentNatsUrl`, the controller's URL under
  `singleHostSwarm`, and the auth responder all dial
  `tls://<swarm.nats.domain>:<port>`. swarm-queue-client hands its CA file
  to the NATS connection too, so hive-c0re and the controller trust the
  leaf's root.
- docs/swarm/README.md: the queue URL and the one DNS record a multi-host
  swarm needs.

module-eval-nats-tls pins the role, the policy, the served leaf, the
firewall, the ordering, and a scan of every `*_NATS_URL` and the
responder's URL across the host and its containers.

Closes #4626

nix/module-eval/core-toggle.nix

@@ -123,19 +123,17 @@ let
         == toString allLocal.services.hyperhive.deploy.hive-controller.queue.agentCredentialDir;
     }
     {
-      # The one address in this file that must NOT be loopback. Both spellings
-      # sit in the same unit's environment and are correct for their own
-      # reader: hive-c0re shares the host netns, an agent container does not,
-      # so a copy-paste between them reaches the agent itself and the symptom
-      # is a connect that hangs.
-      name = "the agents' queue address is the bridge, not the loopback one the hive itself uses";
+      # Inside an agent container loopback is the agent itself, so the agents'
+      # address must never be one. By name it is the same string the hive
+      # dials, which ./nats-tls.nix pins for every client.
+      name = "the agents' queue address is the queue's name, never loopback";
       ok =
         let
           e = allLocal.systemd.services.hive-c0re.environment;
         in
-        e.HIVE_AGENT_NATS_URL == "nats://${allLocal.services.hyperhive.network.bridgeIp}:4222"
+        e.HIVE_AGENT_NATS_URL == "tls://nats.t.local:4222"
         && !(lib.hasInfix "127.0.0.1" e.HIVE_AGENT_NATS_URL)
-        && e.HIVE_AGENT_NATS_URL != e.HIVE_C0RE_NATS_URL;
+        && e.HIVE_AGENT_NATS_URL == e.HIVE_C0RE_NATS_URL;
     }
     {
       # The agents mint against the swarm's IdP, the same endpoint the hive's