hive-matrix: keep tuwunel's OIDC secret on the host's /run, not in the container's root

swarm-bao-matrix-oidc still reads the secret from bao under matrix-ctl's
leaf, but now writes it to /run/hive-matrix-oidc on the host (tmpfs), which
the container bind-mounts read-only for tuwunel's LoadCredential. Before, it
wrote it to
/var/lib/nixos-containers/hive-matrix/var/lib/tuwunel-oidc/<id>.secret on
persistent disk, where a superseded secret stayed after rotation and went
into backups of the container root. Host tmpfiles now removes that old file.

clientSecretFile must now lie under /run/hive-matrix-oidc/, the one directory
the container shares; any other value fails at evaluation.

Rotation is unchanged: the ten-minute timer rewrites the file when the value
differs and refresh_consumer restarts tuwunel. After a reboot the secret is
fetched again; until the store answers, tuwunel does not start.

Part of #4998 (slice 4: tuwunel).

docs/integrations/matrix.md

@@ -400,10 +400,12 @@ SSO is unconditional, so the three below are requirements of running a
 homeserver at all rather than of a setting:
 
 - **Keep `deploy.matrix.sso.clientSecretFile` set** — it defaults to
-  `/var/lib/tuwunel-oidc/<client id>.secret` wherever the homeserver runs,
+  `/run/hive-matrix-oidc/<client id>.secret` wherever the homeserver runs,
   and `swarm-bao-matrix-oidc` writes the secret there from the swarm secret
-  store under matrix-ctl's leaf. A null fails at eval, not at boot: tuwunel
-  reads its identity providers from the config file, so a half-configured
+  store under matrix-ctl's leaf. The path is on the host's tmpfs, so every
+  reboot fetches the secret again and it never reaches persistent disk. A path
+  outside `/run/hive-matrix-oidc/`, or a null, fails at eval, not at boot:
+  tuwunel reads its identity providers from the config file, so a half-configured
   one can stop the homeserver from starting outright rather than merely
   hiding a login button.
 - **Set `swarm.authelia.url`** — without a provider URL there