otel: ship the journals the dashboard can already show

The dashboard's log surface is an allow-list: the four harness units in
every agent container, the hive-ci / hive-forge / hive-matrix machines,
and three host units. `swarm.otel.journaldUnits` only named the host
three plus forgejo — so the units an operator can read in the UI were
absent from the store they are supposed to be queryable in, and nothing
reports that, because a name that matches nothing is not an error.

Adds the four agent units, the CI runner and the homeserver. The agent
units are declared by the hive-c0re module rather than by the
agent-modules that define them: those are a guest evaluation and cannot
reach a host option.

Closes #3818

nix/host-modules/hive-matrix.nix

@@ -501,6 +501,16 @@ in
     # every clause below carries that guard.
     services.hyperhive.gateway.localNames = lib.optional (cfg.gatewayHost != null) cfg.gatewayHost;
 
+    # The homeserver's own journal (`tuwunel` is the unit name inside the
+    # container, whatever the nixpkgs option is called), plus the host-side
+    # oneshot that mints its OIDC secret — carrying the same `ssoLocal`
+    # guard the unit itself is declared under, so the list never names a
+    # unit this deployment does not define.
+    services.hyperhive.swarm.otel.journaldUnits = [
+      "tuwunel"
+    ]
+    ++ lib.optional ssoLocal "hive-matrix-oidc-secret";
+
     # This swarm-ui quick-links entry. Gated on `gui.enable` too, not just
     # `gatewayHost != null`: `/` on that vhost only serves fluffychat
     # (below) when the GUI is on — otherwise the link would 404, the same