swarm-otel: scrape authelia through its published name

Authelia's metrics were scraped over loopback, declared only on a host
running both authelia and the collector, so a split deploy collected none.
Its target is now declared on every host as
`https://<swarm.authelia.domain>/metrics`, next to forgejo's, and authelia's
vhost serves `= /metrics` behind the same collector auth subrequest as the
forge's. The loopback entry is gone, so a single host still scrapes
authelia once, now by name.

The forge-only `metricsRule` becomes `metricsRules`, derived from every
`publishedScrapeTargets` entry. Each target gets the collector-scoped
`one_factor` rule followed by an unconditional `deny`. The `deny` is
needed because authelia 4.39 skips a rule whose `subject` does not
match and moves on. With nothing after the collector rule, any other
authenticated session reached `default_policy = one_factor` and was
admitted. That was already true of the forge's `/metrics`, and this
change closes it there too.

Part of #5205

nix/host-modules/swarm-otel-service.nix

@@ -289,8 +289,9 @@ in
         nothing, which shows as a failing job rather than a missing one.
 
         The collector's OAuth2 client derives its permitted audiences from
-        these URLs, so a target and the authorisation to reach it are **one
-        declaration**.
+        these URLs, and authelia derives from each one the access rule that
+        admits only that client to it, so a target and the authorisation to
+        reach it are **one declaration**.
         Two lists that must agree would be a drift to maintain, and its
         failure mode is the bad one: a target whose audience was forgotten
         authenticates against nothing and reads as a scrape failure rather
@@ -355,5 +356,7 @@ in
   config.services.hyperhive.swarm.otel.publishedScrapeTargets = {
     # The vhost location is in ./hive-forge/default.nix.
     forgejo = "https://${hyperhiveCfg.swarm.forge.domain}/metrics";
+    # The vhost location is in ./swarm-authelia.nix.
+    authelia = "https://${hyperhiveCfg.swarm.authelia.domain}/metrics";
   };
 }