nix: run the review classifier in a container of its own when a host enables it

deploy.review-classifier.enable (off by default, not derived from
allSwarmServices) puts swarm-review-classifier in its own network
namespace on the bridge, with claude-code and the daemon. A host unit
copies the classifier's store leaf into the container; the daemon reads
its queue client secret and the API key from the store with it.

- glue-bao-tls mints the review-classifier leaf; swarm-bao writes the
  swarm-review-classifier role, reading exactly the API key path and the
  classifier's queue client secret; swarm.nix reserves its CN.
- glue-review-classifier-oidc-client registers the machine client where
  authelia runs, and the publisher carries its secret to the store.
- swarm-nats passes the client id to the responder as
  --review-classifier-client.
- Where the host runs a hive-tier collector, claude exports its metrics
  there; the daemon adds the repo and the PR to the resource attributes.
- module-eval: the new grant and leaf (bao-grants, now sixteen granting
  units), the container's presence and its unit (core-toggle), and the
  client registration and publishing (secret-publisher).

nix/host-modules/glue-review-classifier-oidc-client.nix

@@ -0,0 +1,35 @@
+# Glue: register the review classifier as an OIDC client wherever authelia
+# runs.
+#
+# ONE PAIRING PER FILE — swarm-review-classifier ← authelia, and nothing else.
+# Deleting this leaves a classifier whose token requests authelia answers with
+# a 401, and no minted secret for swarm-secret-publish to put in the store.
+#
+# ⚠️ Gated on authelia being HERE, and NOT on this host running the
+# classifier, for ./glue-controller-oidc-client.nix's reason: a client is a row
+# in THIS host's provider config. Registered whether or not any host enables
+# the classifier: nothing in `swarm.*` records that, so a swarm without one
+# carries one unused client and one unused minted secret.
+{
+  lib,
+  config,
+  ...
+}:
+let
+  hyperhiveCfg = config.services.hyperhive;
+  deployCfg = hyperhiveCfg.deploy;
+  clientId = hyperhiveCfg.swarm.review-classifier.clientId;
+in
+{
+  config = lib.mkIf deployCfg.authelia.enable {
+    services.hyperhive.swarm.authelia.oidc.clients = [
+      {
+        id = clientId;
+        description = "HyperHive review classifier";
+        # `client_credentials`: a daemon authenticating as itself.
+        kind = "machine";
+        audience = [ clientId ];
+      }
+    ];
+  };
+}