swarm-nats-auth: read its own OIDC client secret from the store

The responder reads its OIDC client secret at
`swarm/services/<client-id>/oidc/client` with the store login it already
opens for the callout keys, and holds it in memory. `--client-secret-file`
is removed.

When introspection answers non-2xx, the responder re-reads the secret from
the store once and, if it changed, retries the introspection once. Both fit
inside the request's 1.5s introspection budget, under the server's 2s
callout timeout: the budget is now one deadline for the whole request. A
re-read that does not finish by then keeps running in the background, the
request is denied, and the next request introspects with what it read. One
re-read runs at a time; a refusal while one runs waits on it.

In swarm-nats.nix the `swarm-bao-nats-auth-oidc` fetch unit, the flag and
the `oidc-client.secret` LoadCredential entry are gone, along with the
unit's policy ordering in glue-bao-readers-policy-order.nix. A tmpfiles `r`
rule removes the copy a container still holds at
/var/lib/nixos-containers/swarm-nats/var/lib/swarm-nats-auth/oidc-client.secret;
nothing reads it.

No policy change: the `swarm-nats-auth` role already reads this path
(`natsAuthReaders` in swarm-bao.nix), which is the role the removed fetch
unit logged in as.

Deploy order: none, and no operator step. The store's grant already exists,
so the queue host can be deployed before, after or without the store's host
and authelia's. Rolling back re-creates the fetch unit and the file; the
store leaf is untouched.

nix/host-modules/swarm-secret-publisher.nix

@@ -79,8 +79,8 @@ let
     # The store's browser UI, whose `oidc` auth method the store's host
     # configures with this secret.
     hyperhiveCfg.swarm.bao.ui.oidc.clientId
-    # The queue's auth-callout responder, read by `swarm-bao-nats-auth-oidc`
-    # on the queue's host.
+    # The queue's auth-callout responder, which reads it itself on the
+    # queue's host.
     hyperhiveCfg.swarm.nats.clientId
     # The homeserver, read by `swarm-bao-matrix-oidc` on its host.
     hyperhiveCfg.swarm.matrix.sso.clientId