nix: address the swarm IdP by its domain, not by who runs it

`swarm.authelia.url` defaulted to `https://<domain>` only when this host
ran the container, and to `null` otherwise — so the address a client is
given was a statement about co-location rather than about the swarm. A
swarm has one SSO provider; every hive addresses the same name and
resolution decides which address that reaches, exactly as
`swarm.otel.domain` already works.

The option stays nullable: "this swarm has no IdP" is still expressible,
it is just now something an operator states rather than something not
running the container produces. The Grafana fixture that exercised the
no-IdP refusal says it explicitly.

Closes #4536

docs/swarm/services.md

@@ -70,10 +70,12 @@ there is one IdP and one auth path.
 
 - **`deploy.authelia`** — run the container here.
 - **`swarm.authelia.url`** — where clients go to authenticate.
-  Present on **every** hive, defaulting to this host's own instance only
-  when this module is the thing running it; otherwise `null`, and a hive
-  joining someone else's swarm sets it explicitly. Null means "no SSO
-  configured", and consumers say so rather than guessing an address.
+  Present on **every** hive and the same value on all of them:
+  `https://<swarm.authelia.domain>`, whether or not this host runs the
+  container. The name is what a client is given; resolution decides which
+  address it reaches. Set it explicitly when joining a swarm whose IdP is
+  under another name, or to `null` to say the swarm has no SSO — consumers
+  then refuse rather than guessing an address.
 
 swarm-controller writes the users database, not by hand: hive-c0re
 creates and destroys agents continuously, so the subject set is dynamic.