nix: make swarm.authelia.url non-nullable, trim its docs

Review response on #4620: not having SSO is not a supported
deployment, so the type should not permit it, and the docs paragraph
explaining why SSO is always present is redundant once the type says
so.

- swarm.authelia.url drops types.nullOr.
- Every consumer's null-arm is gone: two option defaults
  (swarm-controller's and swarm's own statusPublish.tokenEndpoint)
  that produced an empty/null placeholder when the URL was null now
  unconditionally compute the real derived URL. Five now-dead
  "assertion = ... != null" guards (swarm-authelia's bridge,
  swarm-grafana, swarm-otel, swarm-nats, hive-forge, hive-matrix) are
  removed as unreachable — in every case the same URL was already
  interpolated unconditionally a few lines below the guard.
- grafanaNoSso, the module-eval fixture whose sole purpose was
  exercising the now-unsupported no-IdP refusal, is removed along
  with its dedicated test case; swarm.authelia.url = null is a type
  error now, not a value that reaches that assertion.
- docs/swarm/services.md: cut the clause about setting the option to
  null and the sentence explaining why the URL is co-location-
  independent — both redundant now that the type enforces it.

nix/host-modules/swarm-controller.nix

@@ -382,7 +382,7 @@ in
 
       tokenEndpoint = lib.mkOption {
         type = lib.types.str;
-        default = lib.optionalString (autheliaCfg.url != null) "${autheliaCfg.url}/api/oidc/token";
+        default = "${autheliaCfg.url}/api/oidc/token";
         defaultText = lib.literalExpression ''"''${swarm.authelia.url}/api/oidc/token"'';
         description = ''
           The OIDC token endpoint the controller mints its own access
@@ -773,12 +773,13 @@ in
       {
         assertion = cfg.queue.tokenEndpoint != "";
         message = ''
-          services.hyperhive.swarm.controller.queue.tokenEndpoint is unset,
-          which means services.hyperhive.swarm.authelia.url is null.
+          services.hyperhive.swarm.controller.queue.tokenEndpoint is unset.
 
-          The controller mints its own access token before it may connect
-          to the queue, so it needs to know where the swarm's identity
-          provider lives — set that URL, or set this endpoint directly.
+          It defaults from services.hyperhive.swarm.authelia.url, so this
+          only happens when it has been cleared by hand. The controller
+          mints its own access token before it may connect to the queue,
+          so it needs to know where the swarm's identity provider lives —
+          set this endpoint directly.
         '';
       }
       {