fixture: repair 4 CI failures uncovered on rebase

Refs #4374

- otelNoIdentity: name journaldUnits so the fixture trips the store-
  identity path it's testing instead of swarm-otel's unrelated
  journald-safety assertion (an empty list with log collection on is
  refused as "collect everything", not "collect nothing").
- otelNoStores: give it a bao client identity. The secret gate moved
  from deployCfg.authelia.enable to a real client cert/key pair, so a
  fixture meaning "no telemetry stores" now needs its own secret
  identity to keep exercising the exporter/authenticator wiring it
  was written for.
- docs/swarm/secrets.md: two vale fixes — a contraction, and drop a
  condescending "simply".

nix/module-eval.nix

@@ -498,6 +498,8 @@ let
   otelNoStores = hive {
     deploy.swarm-otel.enable = true;
     deploy.authelia.enable = true;
+    deploy.bao.clientCertFile = "/etc/pki/bao-client.pem";
+    deploy.bao.clientKeyFile = "/etc/pki/bao-client-key.pem";
     deploy.victoriametrics.enable = false;
     deploy.victorialogs.enable = false;
   };
@@ -531,6 +533,7 @@ let
   otelNoIdentity = hive {
     deploy.swarm-otel.enable = true;
     swarm.authelia.url = "https://auth.example.invalid";
+    swarm.otel.journaldUnits = [ "nginx" ];
   };
 
   # authelia somewhere else, the credential delivered by hand. Whether this