feat(swarm-nats): mint the auth-callout nkeys on all-local hives

A hive whose whole swarm is one box had to be handed two nkeys by hand
before its queue could authenticate anyone, which is the one deployment
shape where nobody else can supply them.

`autoGenerateCallout` mints both keypairs on the host on first boot,
keeps the seeds at 0600 host-side, and writes only the public halves
into a fragment the server reads at start. The all-local mode turns it
on; everywhere else the options stay operator-supplied and the
fail-closed eval assertions keep their full force.

The server config is not rewritten to do this. A wrapper includes
upstream's rendered `settings` verbatim plus the runtime fragment, and
the fragment wins — measured, along with the property that makes the
whole shape safe: the empty strings the options render in auto mode are
values `nats-server` refuses to start on, so any field the merge fails
to reach fails closed loudly rather than leaving a walk-in-able server.

The wrapper, the settings symlink and the fragment are siblings in one
runtime directory, and that is forced rather than tidy: NATS resolves an
include with filepath.Join against the config file's own directory,
which strips a leading slash, so an absolute include silently becomes a
relative one and the server never finds it. The includes are therefore
bare filenames. That also means nothing in the closure would otherwise
name the rendered settings, so the generator's symlink to it is what
keeps it from being garbage-collected under a running server.

`accounts` and `authorization` are defined once and rendered twice, into
`settings` and into the fragment template. Written out separately they
would diverge silently and backwards: the fragment is the later
definition, so a future edit to `settings` alone would be ignored on
exactly the hives that use auto mode.

`validateConfig` goes off in auto mode because `nats-server -t` rejects
the empty keys at build time; the parse check moves to server start,
where the fragment exists. Upstream's own option description names this
case.

nix/host-modules/local-defaults.nix

@@ -74,6 +74,12 @@ in
   config.services.hyperhive.swarm = {
     enableRequiredServices = lib.mkDefault cfg.enableAllLocalDefaults;
     ca.autoConfigure = lib.mkDefault cfg.enableAllLocalDefaults;
+    # The queue's auth-callout nkeys. Generating them is safe exactly
+    # when one operator owns both the queue and its responder, which is
+    # what this mode asserts. On any other topology the seeds have to
+    # reach whoever runs the responder, and minting them here would move
+    # that hand-off somewhere less visible rather than removing it.
+    nats.autoGenerateCallout = lib.mkDefault cfg.enableAllLocalDefaults;
     # The controller is asserted by the MODE and by nothing else. Its own
     # option stays `default = false` precisely because running it is a
     # statement about swarm topology — but "this box is the whole