nix: make swarm.authelia.url non-nullable, trim its docs

Review response on #4620: not having SSO is not a supported
deployment, so the type should not permit it, and the docs paragraph
explaining why SSO is always present is redundant once the type says
so.

- swarm.authelia.url drops types.nullOr.
- Every consumer's null-arm is gone: two option defaults
  (swarm-controller's and swarm's own statusPublish.tokenEndpoint)
  that produced an empty/null placeholder when the URL was null now
  unconditionally compute the real derived URL. Five now-dead
  "assertion = ... != null" guards (swarm-authelia's bridge,
  swarm-grafana, swarm-otel, swarm-nats, hive-forge, hive-matrix) are
  removed as unreachable — in every case the same URL was already
  interpolated unconditionally a few lines below the guard.
- grafanaNoSso, the module-eval fixture whose sole purpose was
  exercising the now-unsupported no-IdP refusal, is removed along
  with its dedicated test case; swarm.authelia.url = null is a type
  error now, not a value that reaches that assertion.
- docs/swarm/services.md: cut the clause about setting the option to
  null and the sentence explaining why the URL is co-location-
  independent — both redundant now that the type enforces it.

nix/host-modules/swarm-otel.nix

@@ -1027,22 +1027,6 @@ in
           should not be described as both.
         '';
       }
-      {
-        # A hive proves who it is with a token this provider mints, so
-        # there is no version of this collector that runs without one.
-        # Stated as an assertion rather than a fallback because a guessed
-        # issuer URL evaluates cleanly and refuses every hive at runtime.
-        assertion = hyperhiveCfg.swarm.authelia.url != null;
-        message = ''
-          services.hyperhive.deploy.swarm-otel.enable is true but
-          services.hyperhive.swarm.authelia.url is null: every hive
-          authenticates to this collector as itself, and the token comes
-          from the swarm's identity provider.
-
-          Point authelia.url at the swarm's provider, or enable
-          services.hyperhive.swarm.authelia on the host that runs it.
-        '';
-      }
       {
         # A port collision between two listeners on one host is a runtime
         # coin toss with nothing in any log — the failure this whole