swarm-otel: collect only the units the swarm's services declare

The journald receiver was configured with a directory and no filter, so
the swarm's log store received every unit on the host that runs the
collector. On a hive whose services live on a workstation that includes
the operator's desktop session, in a store every swarm operator can read.

The receiver has no system-only switch and its `matches` field is an
allowlist too, so what the swarm collects has to be stated rather than
excluded. Each service module names its own units: a service that is not
running contributes nothing, and one added later arrives declared.

An empty list is fail-open — the receiver renders no filter at all and
reads everything — so it is asserted against.

nix/host-modules/swarm-grafana.nix

@@ -315,6 +315,14 @@ in
     # hive declaring the vhost would answer for a service it does not have.
     services.hyperhive.gateway.localNames = [ cfg.domain ];
 
+    # The secret oneshots as well as grafana itself: each runs before it and
+    # fails in ways grafana then reports only as a login that does not work.
+    services.hyperhive.swarm.otel.journaldUnits = [
+      "grafana"
+      "swarm-grafana-oidc-secret"
+      "swarm-grafana-secret-key"
+    ];
+
     services.hyperhive.swarm.controller.links = [
       {
         label = "Grafana";