grafana: create the secrets directory before the store login

The three delivery units made /run/swarm-grafana-secrets only after
`bao login` and `bao kv get`, so with the store sealed or unreachable the
bind source was never created by them and a switch could restart the
container without it. Each script now starts with the install, from one
shared `ensureSecretDir`, and the tmpfiles comment says what is true.

The module-eval case asserts the install precedes `bao login` in all three
scripts. docs/swarm/sso.md states that after a reboot Grafana stays down
until the secret store answers.

Part of #4998 (slice 2b: grafana).

nix/module-eval/grafana.nix

@@ -305,9 +305,19 @@ let
           oidc = services.swarm-bao-grafana-oidc.script;
           admin = services.swarm-bao-grafana-admin.script;
           bearer = services.swarm-bao-grafana-metrics-bearer.script;
+          # The bind source must exist when the store refuses the login, so the
+          # directory is made ahead of it in every delivery script.
+          dirBeforeLogin =
+            s:
+            lib.hasInfix "install -d -m 0755 /run/swarm-grafana-secrets" (
+              lib.head (lib.splitString "bao login -method=cert" s)
+            );
         in
         lib.hasInfix "atomic_write_secret 0400 196:0 /run/swarm-grafana-secrets/swarm-grafana.secret" oidc
         && lib.hasInfix "atomic_write_secret 0400 196:0 /run/swarm-grafana-secrets/metrics-bearer" bearer
+        && dirBeforeLogin oidc
+        && dirBeforeLogin admin
+        && dirBeforeLogin bearer
         && !(persistent oidc)
         && !(persistent admin)
         && !(persistent bearer)