docs: describe the forge's OIDC secret as fetched from bao, not copied or hand-placed

sso.md still described a host-side copy unit and an operator-placed file
for a forge elsewhere; secrets.md's client-secret row still named
sso.clientSecretFile as the operator's route. The clientSecretFile
example now shows the path swarm-bao-forge-oidc writes.

Refs #5015

docs/swarm/sso.md

@@ -121,10 +121,17 @@ mechanism with flags.
 
 ### 1. All-local — one host runs both
 
-Nothing to configure at all. Per service, a host-side unit waits for
-authelia's first boot to mint that client's secret and copies it into the
-service's container, and the service's own module contributes its client
-entry — callback URL included — to authelia's client list.
+Nothing to configure at all. authelia mints each client's secret at its
+first boot, and `swarm-secret-publish` on its host writes it to the swarm
+secret store at `swarm/services/<client id>/oidc/client`. A host-side unit
+then reads it from the store and writes it into the service's container:
+`swarm-bao-forge-oidc` for the forge, under the forge publisher's store
+leaf, into `/var/lib/forgejo-oidc/<client id>.secret` (the file
+`forgejo-sso-source` reads); `swarm-bao-matrix-oidc` for matrix, under
+matrix-ctl's. A unit that can't read the secret yet fails and retries
+every 30 seconds for a day, so there is no start order to get right. The
+service's own module contributes its client entry — callback URL
+included — to authelia's client list.
 
 Each relying service's own glue module builds its callback once, and
 both authelia's client list and the service's own OIDC client config
@@ -134,12 +141,10 @@ rejected login with no error text worth reading.
 
 <!-- vale write-good.Passive = NO -->
 
-⚠️ The delivery is a copy, not a `bindMounts` entry, and deliberately so:
-nixos-container refuses to start a container whose bind source is
-missing, and this secret doesn't exist until authelia's first boot has
-run. Binding it would make the service wait on a file that waits on a
-container that starts after it — on a fresh hive, a permanent stall
-presenting as "the forge is broken," many layers from its cause.
+⚠️ The secret is written into the container's state directory, not bound
+in with `bindMounts`: nixos-container refuses to start a container whose
+bind source is missing, and this secret doesn't exist until authelia's
+first boot has run and the publisher has written it.
 
 <!-- vale write-good.Passive = YES -->
 
@@ -151,23 +156,27 @@ written in place).
 
 ### 3. A hive elsewhere
 
-No shared host, so no automatic path. The operator provides the file and
-names it:
+The forge's host needn't be the store's or authelia's host, and the
+operator places no secret file: `swarm-bao-forge-oidc` runs on the
+forge's host as in the all-local case and fetches the secret over the
+store's address. What that host needs is the forge publisher's store
+leaf, issued from the store's CA and copied over from the store's host:
 
 ```nix
-services.hyperhive.swarm = {
-  authelia.url = "https://auth.example.com";
-  forge.sso = {
-    enable = true;
-    clientSecretFile = "/var/lib/hyperhive/forge-oidc-secret";
+services.hyperhive = {
+  swarm.authelia.url = "https://auth.example.com";
+  deploy.bao = {
+    forgePublisherClientCertFile = "/var/lib/swarm-bao-pki/forge-publisher.pem";
+    forgePublisherClientKeyFile = "/var/lib/swarm-bao-pki/forge-publisher-key.pem";
   };
 };
 ```
 
-**This module asserts both at eval.** A hive that boots with SSO
-half-configured shows a login button that always fails — a symptom
-many layers from its cause, and far worse to diagnose than an
-evaluation error.
+**A forge host without that leaf still evaluates.** `swarm-bao-forge-oidc`
+renders and fails at start, naming both options, and the forge has no
+login source until an operator places the leaf. Where the store runs on
+the same host, `glue-bao-tls.nix` defaults both options to the leaf it
+mints.
 
 ## Where each relying party differs