docs(otel): one path, and stop describing a forwarding that no longer happens

The headersCredential section still said hive-c0re forwards the file
into each agent container - that is exactly the behaviour this change
removes, so the doc contradicted the code rather than merely lagging
it. Same for the collector section, which presented the two paths the
change collapses.

Also drops the dangling collector.enable reference in the network
section.

nix/host-modules/otel.nix

@@ -62,16 +62,19 @@
       default = null;
       example = "/run/secrets/otel-headers";
       description = ''
-        Absolute path to an operator-provided secret file whose contents
-        become `OTEL_EXPORTER_OTLP_HEADERS` (e.g.
-        `Authorization=Bearer <token>`). hive-c0re forwards this host
-        file into each agent container's credential store via
-        systemd-nspawn `--load-credential=otel-headers:<path>`; the inner
-        harness unit inherits it by name (`LoadCredential`), so the token
-        is never copied into the nix store, the generated config, a bind
-        mount, or argv. Must be absolute. Leave null if the endpoint
-        needs no auth header. A configured-but-missing file is skipped
-        with a log warning (OTEL still exports, without the auth header).
+        Absolute path to an operator-provided secret file holding the
+        upstream auth header as `NAME=value` (e.g.
+        `Authorization=Bearer <token>`).
+
+        **Only the host-side collector reads this.** It reaches the
+        collector as an `EnvironmentFile`, so the value is never read by
+        nix, never copied into the store or the generated config, and
+        never passed in argv — and it is never forwarded into an agent
+        container, which is the point of the collector existing. Must be
+        absolute.
+
+        Leave null if the upstream needs no auth header; the collector
+        then sends none rather than an empty one.
       '';
     };