swarm-victoriametrics: own network namespace, gateway over a unix socket

The metrics store's container gets privateNetwork = true with no
interface but loopback. VictoriaMetrics listens on
unix:/run/swarm-victoriametrics/victoriametrics.sock, a host directory
(root:nginx 0770) bind-mounted into the container, and every vhost
location that forwarded to 127.0.0.1:8428 now forwards to that socket.

The store runs as a static user whose primary group is nginx's gid,
with UMask 0007, so the socket it creates is 0770 group nginx. This
relies on VictoriaMetrics >= 1.153.0 honouring the umask (the locked
nixpkgs ships 1.153.0). nixpkgs' readiness loop curls a TCP URL, so
postStart is replaced with the same loop over --unix-socket.

swarm.victoriametrics.port is removed (nothing binds it any more), with
a mkRemovedOptionModule entry, and dropped from swarm-otel's host
port-collision assertion. The container's resolver unit is dropped:
there is no interface to reach the bridge resolver through, and the
store resolves no names.

The collector scrape, the collector push and Grafana's datasource
already reach the store by its published domain, so they are unchanged.

Refs #4815
Refs #3560

nix/host-modules/swarm-victorialogs.nix

@@ -455,8 +455,7 @@ in
             enable = true;
             package = deployCfg.victorialogs.package;
 
-            # ⚠️ PINNED TO LOOPBACK for the same reason the metrics store is,
-            # and it matters more here: upstream's default listens on every
+            # ⚠️ PINNED TO LOOPBACK: upstream's default listens on every
             # interface, and this endpoint accepts writes as well as reads.
             # Nothing authenticates it either — upstream offers one basic-auth
             # pair (`-httpAuth.username` / `-httpAuth.password`) and this