swarm metrics store: the read API needs Grafana's bearer or an operator session

The metrics vhost forwarded the store's read API (query, series, labels,
export, vmui, ...) with no credential, so anything that could reach
metrics.<swarm> could read every hive's and agent's metrics. mara ruled on
checked by an auth_request responder, and operators use their authelia
session.

- swarm-metrics-auth (new crate): auth_request responder on the metrics
  store's host. Compares the presented bearer, in constant time, with the
  one stored at swarm/services/<grafana client id>/metrics/bearer, read
  under its own bao leaf and cached for 60s. Static user, the post-#5264
  swarm-logs-auth unit shape.
- swarm-bao-grafana-metrics-bearer: on Grafana's host, creates that bearer
  in bao if absent (create without update, Grafana's existing leaf) and
  writes "Bearer <value>" into the container; the datasource sends it as
  its Authorization header via $__file{}.
- The vhost: read locations take auth_request through a map (a bearer goes
  to swarm-metrics-auth, anything else to authelia, no login redirect);
  vmui takes an authelia session with the login redirect; forceSSL like
  the logs vhost. The authelia subrequest location is renamed from
  /__metrics_push_authz to /__metrics_authelia since it now serves reads.
- Authelia: the collector keeps every path; everyone else is refused the
  collector's push and /metrics paths; group admins is admitted to the
  rest; then deny.
- bao: a swarm-metrics-auth cert role and policy (read on the one leaf),
  its leaf minted by glue-bao-tls, the CN reserved as a hive name, and
  Grafana's grant gains create on the bearer leaf.

Fixes #3596

docs/swarm/services.md

@@ -171,14 +171,29 @@ Grafana start — see [`secrets.md`](secrets.md).
 Neither container is reachable except through the gateway: each listens
 on a unix socket only the gateway's nginx can open, and VictoriaMetrics
 runs in a network namespace of its own with no interface but loopback.
-VictoriaMetrics authenticates nothing itself. The
-`metrics.<swarm-domain>` vhost forwards only the store's read API (the
-Prometheus query, series, label and metadata routes, plus the vmui web UI)
-without a credential. It forwards the collector's OTLP push, and the
-collector's scrape of the store's own `/metrics`, only for the swarm
-collector's authelia client: authelia refuses any other session or client
-there. It refuses every other path, the store's write and admin
-API included, with 403. The bare domain redirects to vmui.
+VictoriaMetrics authenticates nothing itself; the `metrics.<swarm-domain>`
+vhost does it:
+
+- **The read API** (the Prometheus query, series, label and metadata
+  routes): Grafana's datasource or an operator. Grafana sends a bearer that
+  `swarm-bao-grafana-metrics-bearer` creates in the swarm secret store, and
+  `swarm-metrics-auth` on the store's host checks it against the same store
+  path. A request without a bearer needs an operator's authelia session
+  (group `admins`); without one it gets a 401, not a login redirect.
+- **vmui**: an operator's authelia session, with a redirect to the login.
+  The bare domain redirects to vmui.
+- **The collector's OTLP push, and its scrape of the store's own
+  `/metrics`**: only the swarm collector's authelia client. Authelia refuses
+  any other session or client there, operators included.
+- **Every other path**, the store's write and admin API included: 403.
+
+`swarm-metrics-auth` reads the store with a leaf of its own,
+`deploy.victoriametrics.authBaoClientCertFile` / `authBaoClientKeyFile`.
+Where the secret store runs on the same host, these default to the leaf it
+mints. On any other host you place a leaf whose CN is
+`deploy.bao.metricsAuthCommonName`, and evaluation refuses the config until
+you set both. It reads the stored bearer at most once a minute, so a
+replaced bearer starts working up to a minute later.
 
 The collector scrapes Grafana's own metrics at
 `https://<swarm.grafana.domain>/metrics`, so a collector on a host without