swarm metrics store: the read API needs Grafana's bearer or an operator session

The metrics vhost forwarded the store's read API (query, series, labels,
export, vmui, ...) with no credential, so anything that could reach
metrics.<swarm> could read every hive's and agent's metrics. mara ruled on
checked by an auth_request responder, and operators use their authelia
session.

- swarm-metrics-auth (new crate): auth_request responder on the metrics
  store's host. Compares the presented bearer, in constant time, with the
  one stored at swarm/services/<grafana client id>/metrics/bearer, read
  under its own bao leaf and cached for 60s. Static user, the post-#5264
  swarm-logs-auth unit shape.
- swarm-bao-grafana-metrics-bearer: on Grafana's host, creates that bearer
  in bao if absent (create without update, Grafana's existing leaf) and
  writes "Bearer <value>" into the container; the datasource sends it as
  its Authorization header via $__file{}.
- The vhost: read locations take auth_request through a map (a bearer goes
  to swarm-metrics-auth, anything else to authelia, no login redirect);
  vmui takes an authelia session with the login redirect; forceSSL like
  the logs vhost. The authelia subrequest location is renamed from
  /__metrics_push_authz to /__metrics_authelia since it now serves reads.
- Authelia: the collector keeps every path; everyone else is refused the
  collector's push and /metrics paths; group admins is admitted to the
  rest; then deny.
- bao: a swarm-metrics-auth cert role and policy (read on the one leaf),
  its leaf minted by glue-bao-tls, the CN reserved as a hive name, and
  Grafana's grant gains create on the bearer leaf.

Fixes #3596

nix/host-modules/swarm-authelia.nix

@@ -97,14 +97,43 @@ let
     )
     ++ [ (target // { policy = "deny"; }) ];
 
-  # The metrics store's name, every path. Only its push route and `/metrics`
-  # consult authelia (its read API is served with no check), and the
-  # collector is the one caller of both, so the rules take no `resources`
-  # and leave no path or query form to fall through to `default_policy`.
-  # ⚠️ An authenticated location added to that vhost for anyone else is
-  # refused here until it gets a rule ahead of the `deny`.
+  # The metrics store's name, every path. Authelia is consulted there for the
+  # collector's push route and `/metrics`, and for an operator's session on
+  # the read API and vmui; Grafana's bearer on the read API is checked by
+  # `swarm-metrics-auth`, never here.
+  #
+  # The collector's client is admitted anywhere on the name. Every other
+  # subject is refused the collector's two paths, then operators are admitted
+  # to the rest, then everything else is refused. Prefixes rather than exact
+  # paths for the collector's two, so no spelling of them reaches the
+  # operator rule. No rule takes a narrower `resources` than that, so no path
+  # or query form falls through to `default_policy`.
   metricsStoreDomain = config.services.hyperhive.swarm.victoriametrics.domain;
-  metricsStoreRules = collectorOnly { domain = metricsStoreDomain; };
+  metricsStoreRules =
+    lib.optional collectorRegistered {
+      domain = metricsStoreDomain;
+      policy = "one_factor";
+      subject = [ "oauth2:client:${collectorClientId}" ];
+    }
+    ++ [
+      {
+        domain = metricsStoreDomain;
+        policy = "deny";
+        resources = [
+          "^/opentelemetry/.*"
+          "^/metrics.*"
+        ];
+      }
+      {
+        domain = metricsStoreDomain;
+        policy = "one_factor";
+        subject = [ "group:${operatorGroup}" ];
+      }
+      {
+        domain = metricsStoreDomain;
+        policy = "deny";
+      }
+    ];
 
   # One pair per `swarm.otel.publishedScrapeTargets` entry, read off the same
   # URL the collector requests and its token is minted for, so a target