swarm snapshot store: the receiver socket binds the mesh address even when wg-hive comes up after sockets.target

The socket is wanted by sockets.target and nothing orders the wireguard
unit before it, so the mesh address can be missing at bind time
(EADDRNOTAVAIL) and the receiver never listens. FreeBind lets the bind
succeed regardless, and also covers the interface coming back after a flap.

Also assert the mesh address is not a wildcard, which the comment above the
socket already claimed, and cover the rendered socket in a module-eval case.

docs/networking/snapshot-store.md

@@ -123,10 +123,15 @@ somebody already thought of.
 ## Reachability
 
 The receiver is socket-activated, and the socket binds **this host's
-mesh address**, never a wildcard. The module asserts two things: the
-mesh is on, and the address isn't empty --- neither is just documentation: bound to
-`0.0.0.0` this socket is an unauthenticated remote write into agent
-state.
+mesh address**, never a wildcard. The module asserts three things: the
+mesh is on, the address isn't empty, and it isn't `0.0.0.0` or `::` ---
+none is just documentation: bound to a wildcard this socket is an
+unauthenticated remote write into agent state.
+
+The socket sets `FreeBind`, so the bind succeeds before `wg-hive` has
+its address. Nothing orders the wireguard unit before `sockets.target`,
+and without it the bind fails with `EADDRNOTAVAIL` at boot and the
+receiver never listens.
 
 Binding isn't sufficient on its own. NixOS's firewall is default-deny
 and filters in netfilter, _before_ a packet reaches a bound socket, so