swarm-nats-auth: read its own OIDC client secret from the store

The responder reads its OIDC client secret at
`swarm/services/<client-id>/oidc/client` with the store login it already
opens for the callout keys, and holds it in memory. `--client-secret-file`
is removed.

When introspection answers non-2xx, the responder re-reads the secret from
the store once and, if it changed, retries the introspection once. Both fit
inside the request's 1.5s introspection budget, under the server's 2s
callout timeout: the budget is now one deadline for the whole request. A
re-read that does not finish by then keeps running in the background, the
request is denied, and the next request introspects with what it read. One
re-read runs at a time; a refusal while one runs waits on it.

In swarm-nats.nix the `swarm-bao-nats-auth-oidc` fetch unit, the flag and
the `oidc-client.secret` LoadCredential entry are gone, along with the
unit's policy ordering in glue-bao-readers-policy-order.nix. A tmpfiles `r`
rule removes the copy a container still holds at
/var/lib/nixos-containers/swarm-nats/var/lib/swarm-nats-auth/oidc-client.secret;
nothing reads it.

No policy change: the `swarm-nats-auth` role already reads this path
(`natsAuthReaders` in swarm-bao.nix), which is the role the removed fetch
unit logged in as.

Deploy order: none, and no operator step. The store's grant already exists,
so the queue host can be deployed before, after or without the store's host
and authelia's. Rolling back re-creates the fetch unit and the file; the
store leaf is untouched.

swarm-nats-auth/README.md

@@ -64,10 +64,15 @@ paths and the boot order.
 - **Every credential is a path, never a value.** A value in nix config lands
   in the world-readable store; a value in `argv` is readable via
   `/proc/<pid>/cmdline`, which is `0444`. Paths are not secrets, so passing
-  them as flags is fine.
+  them as flags is fine. The secrets themselves, the callout seeds and the
+  responder's own OIDC client secret, are read from the secret store and held
+  in memory.
 - **The introspection timeout is pinned below the server's `authorization.
 timeout`**, with a test asserting the relation — a responder that answers
   after the server gave up is indistinguishable from one that never answered.
+  It is one request's whole budget: when the `IdP` refuses the responder's own
+  secret, the re-read from the store and the one retry fit inside it, or the
+  request is denied and the re-read lands for the next one.
 
 ## What the tests do and do not cover