feat(swarm-victoriametrics): scrape the store's own prometheus endpoint

The scraper shipped with no targets, so nothing exercised it. This is its
first user, and the one with the least new surface: victoriametrics
publishes prometheus metrics on the listener it already serves queries on,
so there is no exporter, no extra port and no new reach — the collector's
otlphttp exporter already writes to that same loopback address.

Declared from this module rather than the collector's, per the option's own
rule: an entry exists only where the service that named it runs.

nix/host-modules/swarm-victoriametrics.nix

@@ -113,6 +113,21 @@ in
       }
     ];
 
+    # This store publishes its own health as prometheus metrics on the same
+    # listener it serves queries on, so the swarm's collector can scrape it
+    # with no exporter and no extra port.
+    #
+    # Declared here rather than in the collector's module because that is the
+    # rule the option carries: an entry exists only where the service that
+    # named it runs, which is what keeps scraper and target on one host by
+    # construction instead of by luck.
+    #
+    # The loopback literal introduces no new assumption — it is the address
+    # this module already pins the listener to, and the same one the
+    # collector's `otlphttp/victoriametrics` exporter already writes to. If
+    # that reach is ever wrong, it is wrong for the write path first.
+    services.hyperhive.swarm.otel.scrapeTargets.victoriametrics = "127.0.0.1:${toString cfg.port}";
+
     services.nginx.virtualHosts."${cfg.domain}" = (gatewayCfg.lib.tlsFor cfg.domain) // {
       listen = gatewayCfg.lib.listen;
       extraConfig = gatewayCfg.lib.securityHeaders;