nix: make swarm.authelia.url non-nullable, trim its docs

Review response on #4620: not having SSO is not a supported
deployment, so the type should not permit it, and the docs paragraph
explaining why SSO is always present is redundant once the type says
so.

- swarm.authelia.url drops types.nullOr.
- Every consumer's null-arm is gone: two option defaults
  (swarm-controller's and swarm's own statusPublish.tokenEndpoint)
  that produced an empty/null placeholder when the URL was null now
  unconditionally compute the real derived URL. Five now-dead
  "assertion = ... != null" guards (swarm-authelia's bridge,
  swarm-grafana, swarm-otel, swarm-nats, hive-forge, hive-matrix) are
  removed as unreachable — in every case the same URL was already
  interpolated unconditionally a few lines below the guard.
- grafanaNoSso, the module-eval fixture whose sole purpose was
  exercising the now-unsupported no-IdP refusal, is removed along
  with its dedicated test case; swarm.authelia.url = null is a type
  error now, not a value that reaches that assertion.
- docs/swarm/services.md: cut the clause about setting the option to
  null and the sentence explaining why the URL is co-location-
  independent — both redundant now that the type enforces it.

nix/host-modules/swarm-grafana.nix

@@ -109,18 +109,6 @@ let
   # operator sees, not a coercion error from here.
   domainBase = if swarmDomain == null then "invalid" else swarmDomain;
 
-  # Is SSO configured for this SWARM. Swarm-wide by construction — `swarm.*` is
-  # identical on every host — and the option's own description is what makes
-  # this the right question to ask: a null URL means "no SSO configured".
-  #
-  # 🩸 A subject of an assertion below, NOT a gate. Dropping the OIDC block when
-  # this is false looks conservative and is the outage: `disable_login_form` is
-  # unconditional a few hundred lines down, so a Grafana with no OIDC settings
-  # is a Grafana with no login of any kind, arrived at silently. SSO is a
-  # requirement of running this service, so an unconfigured swarm fails to
-  # build and says which option to set.
-  ssoConfigured = hyperhiveCfg.swarm.authelia.url != null;
-
   # A reader of the store is defined by holding a certificate the store
   # accepts, never by standing next to it — the rule
   # ./glue-matrix-bao-token.nix states in full.
@@ -448,34 +436,11 @@ in
     # host that runs authelia, and this whole block is gated on the host that
     # runs Grafana. ./glue-grafana-oidc-client.nix is where it moved to.
 
-    # Both arms are what used to be a silent gate, and both fire only where
-    # Grafana runs — this whole block is under `deploy.grafana.enable`. The
-    # binding itself is asserted rather than a copy of its formula, the way
-    # ./swarm-nats.nix's own `autheliaUrl` arm does it: two spellings of one
-    # boolean is two places for a future edit to land in only one.
+    # This arm fires only where Grafana runs — this whole block is under
+    # `deploy.grafana.enable`. SSO itself needs no assertion any more:
+    # `swarm.authelia.url` is non-nullable, so every swarm has one and the
+    # OIDC block below always names a real endpoint.
     assertions = [
-      {
-        # SSO is not optional for this service, and the reason is a hundred
-        # lines below in `auth.disable_login_form = true`: Grafana ships an
-        # `admin`/`admin` account on a public vhost, so the password box is
-        # off whatever the topology. Emitting no OIDC block when the swarm
-        # names no IdP therefore produces a container with no way in at all —
-        # a state no log names, since nothing failed. Failing the build and
-        # naming the option is the only report that reaches anyone.
-        assertion = ssoConfigured;
-        message = ''
-          services.hyperhive.deploy.grafana.enable requires
-          services.hyperhive.swarm.authelia.url — Grafana's only login is SSO,
-          because its local login form is disabled unconditionally (it ships
-          an admin/admin account and its vhost is on the public gateway).
-
-          It defaults to this host's own instance only when this host runs
-          authelia. A hive that federates with a swarm sets it explicitly to
-          wherever that provider lives. Grafana exchanges its authorization
-          code at `''${url}/api/oidc/token` from inside its container, so a
-          null URL leaves no endpoint to name.
-        '';
-      }
       {
         # The other half of one login: the OIDC block names a `$__file{}` that
         # `swarm-bao-grafana-oidc.service` below writes, and that unit reads