swarm-ui: link the secret store's web UI from swarm.bao.ui.domain

The swarm-controller adds a Bao quick link built from
services.hyperhive.swarm.bao.ui.domain, so the popover links the
store's browser UI whichever host runs bao.

Refs #4885

docs/swarm/ui.md

@@ -114,6 +114,7 @@ same whichever host runs each service:
 | Metrics  | `services.hyperhive.swarm.victoriametrics.domain` |
 | Logs     | `services.hyperhive.swarm.victorialogs.domain`    |
 | Matrix   | `services.hyperhive.swarm.matrix.gatewayHost`     |
+| Bao      | `services.hyperhive.swarm.bao.ui.domain`          |
 
 `nix/host-modules/swarm-controller.nix` builds these entries. The Forge
 entry, and `swarm-ui.nix`'s entry for this UI's own API docs, come from
@@ -127,6 +128,9 @@ gateway host, `chat.<swarm domain>` by default. The homeserver's host
 always serves the client at `/` on that vhost, so the entry is present
 whenever the swarm names a gateway host.
 
+The **Bao** entry opens the secret store's web UI, which admits members of
+authelia's `admins` group only; see [`secrets.md`](secrets.md#the-browser-ui).
+
 <details><summary>Adding a swarm service name: the two wiring sites</summary>
 
 Adding a swarm service name means touching two things. Missing the

nix/host-modules/swarm-controller.nix

@@ -51,6 +51,11 @@ let
           icon = "📜";
           inherit (swarmCfg.victorialogs) domain;
         }
+        {
+          label = "Bao";
+          icon = "🔐";
+          inherit (swarmCfg.bao.ui) domain;
+        }
       ]
     # A null `gatewayHost` means no vhost fronts the homeserver, so there is
     # no web client to link to.
@@ -458,7 +463,8 @@ in
         or swarm-ui change.
 
         The Authelia, Grafana, Metrics and Logs entries come from
-        `services.hyperhive.swarm.<service>.domain`, and the Matrix entry
+        `services.hyperhive.swarm.<service>.domain`, the Bao entry from
+        `services.hyperhive.swarm.bao.ui.domain`, and the Matrix entry
         from `services.hyperhive.swarm.matrix.gatewayHost` when it is set,
         so they are present whichever host runs each service.
         `hive-forge/default.nix` and `swarm-ui.nix` contribute their own

nix/module-eval/swarm-services-switch.nix

@@ -116,8 +116,8 @@ let
       Metrics = s.victoriametrics.domain;
       Logs = s.victorialogs.domain;
       Matrix = s.matrix.gatewayHost;
+      Bao = s.bao.ui.domain;
       # forge: added once hive-forge/default.nix drops its per-host link
-      # bao: its web UI at `swarm.bao.ui.domain` has no link yet
     };
   swarmServiceLinksOf =
     cfg: