nix: make swarm.authelia.url non-nullable, trim its docs

Review response on #4620: not having SSO is not a supported
deployment, so the type should not permit it, and the docs paragraph
explaining why SSO is always present is redundant once the type says
so.

- swarm.authelia.url drops types.nullOr.
- Every consumer's null-arm is gone: two option defaults
  (swarm-controller's and swarm's own statusPublish.tokenEndpoint)
  that produced an empty/null placeholder when the URL was null now
  unconditionally compute the real derived URL. Five now-dead
  "assertion = ... != null" guards (swarm-authelia's bridge,
  swarm-grafana, swarm-otel, swarm-nats, hive-forge, hive-matrix) are
  removed as unreachable — in every case the same URL was already
  interpolated unconditionally a few lines below the guard.
- grafanaNoSso, the module-eval fixture whose sole purpose was
  exercising the now-unsupported no-IdP refusal, is removed along
  with its dedicated test case; swarm.authelia.url = null is a type
  error now, not a value that reaches that assertion.
- docs/swarm/services.md: cut the clause about setting the option to
  null and the sentence explaining why the URL is co-location-
  independent — both redundant now that the type enforces it.

nix/host-modules/swarm-authelia.nix

@@ -457,7 +457,7 @@ in
     };
 
     url = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
+      type = lib.types.str;
       default = "https://${cfg.domain}";
       defaultText = lib.literalExpression ''"https://''${domain}"'';
       example = "https://auth.example.com";
@@ -474,9 +474,8 @@ in
         wrong, the same way {option}`services.hyperhive.swarm.otel.domain`
         has none.
 
-        Still nullable, for a deployment that has to say "this swarm has
-        no IdP" explicitly; consumers refuse rather than invent an
-        address when it is null.
+        Not having SSO is not a supported deployment: every swarm has an
+        IdP, so this is never `null`.
       '';
     };
 
@@ -953,18 +952,6 @@ in
       # would reject it, but three layers away and at boot — naming both
       # sources here is the cheaper failure.
       ++ [
-        {
-          # The bridge introspects by name, so a null URL becomes a nix
-          # coercion error several files from its cause. Only reachable by
-          # enabling authelia and clearing `url` by hand — an assertion
-          # rather than a fallback, because a guessed URL that evaluates
-          # cleanly is worse than a refused build.
-          assertion = cfg.url != null;
-          message =
-            "services.hyperhive.swarm.authelia.url must not be null when authelia "
-            + "is enabled: swarm-authelia-bridge introspects at "
-            + "`\${url}/api/oidc/introspection` from inside its container.";
-        }
         {
           assertion = lib.length (lib.unique (map (c: c.id) cfg.oidc.clients)) == lib.length cfg.oidc.clients;
           message =