bao: serve the browser UI to admins via a loopback-only listener

openbao gains a second listener, `ui`, on 127.0.0.1:<deploy.bao.uiPort>
(default 8204) with TLS off and no client-certificate requirement, and
`ui = true`. The existing listeners are unchanged. An nginx inside the
store's container, on 127.0.0.1:<deploy.bao.uiProxyPort> (default 8206),
forwards only /ui/ and /v1/ to it, redirects / to /ui/, answers 403 on
sys/unseal, sys/seal, sys/step-down, sys/rekey* and sys/generate-root*,
and 404 on everything else.

The gateway on the store's host serves `swarm.bao.ui.domain` (default
bao-ui.<swarm>) behind the authelia auth_request subrequest, proxying to
that nginx; the name joins serviceDomains and localNames like every
other gateway-published swarm service. authelia gets an access_control
rule restricting that name to group:admins, rendered wherever authelia
runs, since the default policy admits any session.

Trade-off, ruled by the operator on the parent issue: the UI listener
asks for no client certificate, so on that door a bao token alone is the
credential.

Three comments and a doc line claimed every API listener demands a
client certificate; they now except the loopback UI listener. The
module-eval case counting declared listeners excludes `ui` by name, as
it already did `metrics`.

On a self-signed gateway, the UI's name is a swarm service name, so its
host requests the services leaf from the store. `swarm-services-cert`
sits Before= and RequiredBy= the gateway's cert import, which nginx
Requires=. On a host whose only swarm name is the UI, that would hold
nginx, and with it the stream passthrough every reader dials, on a login
to a store that may be sealed. hive-tls drops those two edges exactly
when the UI is the only local swarm name: nginx starts on the existing
hive-leaf fallback, and the script's existing re-import reloads nginx
once the leaf issues. Every other host keeps both edges.

nix/module-eval/bao-otel-collector.nix

@@ -115,13 +115,19 @@ let
     }
     {
       # Control for the case above: these settings are rendered per deployment,
-      # not constants a passing case could be indifferent to. The metrics
-      # listener is excluded by name — it answers on a port of its own and is
-      # not one of the API addresses this case is counting.
+      # not constants a passing case could be indifferent to. The metrics and
+      # UI listeners are excluded by name — each answers on a loopback port of
+      # its own and is not one of the declared addresses this case is counting.
       name = "a declared extra address renders a second listener beside loopback";
       ok =
         builtins.length (
-          builtins.filter (n: n != "metrics") (builtins.attrNames (baoSettings baoTwoAddresses).listener)
+          builtins.filter (
+            n:
+            !(builtins.elem n [
+              "metrics"
+              "ui"
+            ])
+          ) (builtins.attrNames (baoSettings baoTwoAddresses).listener)
         ) == 2;
     }
     {