feat(swarm): wire a hive's queue coordinates for status publishing

Three options, all three derived from ONE predicate — this host runs both
the queue and the IdP — so a defaulted set is all or nothing. Deriving
them per-service looks equivalent and is not: `enableRequiredServices`
turns on matrix and authelia but not nats, so an ordinary all-local hive
would resolve two of three and trip the assertion below. Making the
partial state unrepresentable is what keeps that assertion honest.

Deliberately not the shape swarm-controller uses. That module emits its
queue coordinates only when authelia and NATS are local, which is right
for a service that *is* a swarm-host service — but a hive is the one thing
in a swarm that routinely is not on the swarm host, so the same rule would
make status publishing work on exactly the deployment that needs it least.

There is no `enable`: three coordinates that are all set is the enable. An
extra flag would allow configured-but-off, which is one more state to
explain and one more way to be silently quiet.

A half-set trio is an eval error rather than a silent no-op, because its
runtime failure mode is the expensive kind — the daemon comes up fine,
never connects, and the hive reads never_reported on a dashboard nobody is
watching yet. With the defaults all-or-nothing, the assertion only ever
judges what an operator typed by hand.

The secret arrives by LoadCredential, not a copy: hive-c0re is a host
unit, so systemd hands it the file directly and the secret never gains a
second on-disk copy. The client id is not chosen here either — it is
`hive-<hiveName>`, the identity swarm-authelia.nix already declares for
every entry in the roster.

nix/host-modules/hive-c0re/environment.nix

@@ -209,3 +209,22 @@ in
     in
     "${s.address}:${toString s.port}";
 }
+//
+  # Swarm-queue coordinates for offering this hive's status upward
+  # (hive-c0re::swarm_status). All four together or none: a half-set
+  # environment is a deployment bug the daemon refuses to treat as
+  # "no queue configured", because the failure it would otherwise
+  # produce is a hive that comes up fine and silently never reports.
+  # The three-option version of that same rule is asserted at eval in
+  # ./../swarm.nix, so this can only ever emit a complete set.
+  lib.optionalAttrs (config.services.hyperhive.swarm.statusPublish.natsUrl != null) {
+    HIVE_C0RE_NATS_URL = config.services.hyperhive.swarm.statusPublish.natsUrl;
+    HIVE_C0RE_OIDC_TOKEN_ENDPOINT = config.services.hyperhive.swarm.statusPublish.tokenEndpoint;
+    # The identity swarm-authelia.nix already declares for every entry in
+    # `swarm.hives` — the hive does not choose its own name here, it uses
+    # the one the roster gave it.
+    HIVE_C0RE_OIDC_CLIENT_ID = "hive-${config.services.hyperhive.hiveName}";
+    # `%d` is systemd's credentials directory — see the LoadCredential in
+    # ./default.nix. The daemon reads a path, never a value.
+    HIVE_C0RE_OIDC_CLIENT_SECRET_FILE = "%d/swarm-status-client.secret";
+  }