feat(3083): the gateway serves authelia

authelia has listened on 127.0.0.1:9091 since it was stood up, with
nothing proxying to it — so `auth.<swarm.domain>` resolved and then
refused the connection. This is the vhost that was never written.

Follows forge and matrix exactly: one `optionalAttrs` attrset merged into
`virtualHosts`, TLS chosen by `vhostTlsFor` (the swarm-services leaf
already names it, since `swarm.serviceDomains` includes
`authelia.domain`), and the same four wiring sites those two occupy —
vhost, dnsmasq address, local-dev `/etc/hosts`, and the arg lists that
feed both files.

Gated on this host running the container, not on authelia being
configured: every hive knows the swarm's `authelia.url`, but only the one
serving it may claim the name. A client hive declaring this vhost would
answer for a service it does not run.

Two things that are deliberate rather than incidental:

`X-Forwarded-{Proto,Host,Uri,For}` are set because authelia decides by
the *original* request — the login redirect and the session cookie's
domain both derive from them. Without them every request looks like it
arrived at 127.0.0.1 over plain http.

And no `auth_basic`. Applying the gateway's basic-auth block to the SSO
provider would put the login page behind the login mechanism it exists to
replace.

nix/host-modules/hive-gateway/default.nix

@@ -22,6 +22,7 @@ let
   # same list rather than each deciding what "a swarm service" means.
   swarmServiceDomains = config.services.hyperhive.swarm.serviceDomains;
   matrixCfg = config.services.hyperhive.swarm.matrix;
+  autheliaCfg = config.services.hyperhive.swarm.authelia;
   forgeCfg = config.services.hyperhive.swarm.forge;
   networkCfg = config.services.hyperhive.network;
 
@@ -70,6 +71,7 @@ let
       cfg
       forgeCfg
       matrixCfg
+      autheliaCfg
       hyperhiveDomain
       dashboardDist
       swaggerUiTheme
@@ -309,6 +311,7 @@ in
         networkCfg
         forgeCfg
         matrixCfg
+        autheliaCfg
         hyperhiveDomain
         ;
     };
@@ -332,6 +335,7 @@ in
         ++ lib.optional (config.services.hyperhive.swarm.forge.behindGateway or false
         ) config.services.hyperhive.swarm.forge.domain
         ++ lib.optional (matrixCfg.enable && matrixCfg.gatewayHost != null) matrixCfg.gatewayHost
+        ++ lib.optional autheliaCfg.enable autheliaCfg.domain
       );
     };
   };