trust the swarm services ca in swarm-ci-metrics

The poller's forge, authelia and collector calls go to leaves issued by
the swarm's own CA, and its reqwest/rustls roots come from SSL_CERT_FILE,
which the unit never set. Every pass since it was deployed fails
"invalid peer certificate: UnknownIssuer" before pushing, so the CI runs
dashboard has no hyperhive.ci.run.* samples (#5438).

- nix/host-modules/swarm-ci-metrics.nix: import lib/hive-ca-trust.nix and
  register a host trustBundle for the unit, as swarm-controller does; it
  adds swarm-ci-metrics-ca-bundle.service and sets SSL_CERT_FILE.
- nix/module-eval/ci-metrics.nix: a case asserting the unit's
  SSL_CERT_FILE is its bundle path when self-signed, with the bundle
  unit's ordering, and absent where the poller is off.
- docs/swarm/ci-metrics.md: how the poller trusts the swarm's CA.

nix/host-modules/swarm-ci-metrics.nix

@@ -14,6 +14,7 @@
 # its store leaf, handed in by `LoadCredential=`; the forge token and its OIDC
 # client secret it reads from the store under that leaf on every pass.
 {
+  pkgs,
   lib,
   config,
   ...
@@ -40,6 +41,16 @@ let
   haveClientIdentity =
     baoDeploy.ciMetricsClientCertFile != null && baoDeploy.ciMetricsClientKeyFile != null;
 
+  # The forge, authelia and the collector serve leaves issued by the swarm's
+  # own CA, which the system store lacks, and the poller's `reqwest`/`rustls`
+  # roots come from `SSL_CERT_FILE`, which replaces that store. `trustBundle`
+  # below sets it to the system CAs plus the hive anchor; without it every
+  # pass fails `invalid peer certificate: UnknownIssuer`.
+  caTrust = import ./lib/hive-ca-trust.nix {
+    inherit lib gatewayCfg;
+    tlsCfg = hyperhiveCfg.deploy.hive-controller.tls;
+  };
+
   credential = id: "/run/credentials/${unit}.service/${id}";
   # Credential id → host path of the poller's store identity.
   storeFiles = {
@@ -51,6 +62,20 @@ let
   };
 in
 {
+  # `hostUnit`: a host service, so the bundle reads the host CA path and waits
+  # on `hive-tls-ca.service`. `enable`: `imports` is unconditional, so without
+  # it a host with the poller off gets the bundle unit and an `ExecStart`-less
+  # `swarm-ci-metrics` service.
+  imports = [
+    (caTrust.trustBundle {
+      inherit pkgs;
+      name = unit;
+      consumers = [ unit ];
+      hostUnit = true;
+      inherit (cfg) enable;
+    })
+  ];
+
   options.services.hyperhive.swarm.ci-metrics.clientId = lib.mkOption {
     type = lib.types.str;
     readOnly = true;