fix(swarm-nats): the metrics exporter needs a collector flag or it exits

prometheus-nats-exporter has never served a metric. Upstream's module
renders `-addr … -port … ${extraFlags} ${url}` and defaults extraFlags
to the empty list, but the binary refuses to start without at least one
collector: it exits 1 with "no Collectors specified". So the unit logged
Started, the process was gone milliseconds later, and every scrape was
refused -- up=0 continuously, scrape_duration 0.6ms, zero samples.

Verified by running the exact argv both ways: without a collector it
exits 1, with -varz it stays up and logs the listener. A bogus flag is
rejected with exit 2, so the check measures acceptance rather than
tolerance.

varz is the server itself, connz makes a client that will not stay
connected visible, and jsz covers JetStream, which this swarm uses for
the status KV. The rest describe a clustered deployment we do not have.

An empty list is not a neutral default when the program requires a flag,
and nothing about it is visible to evaluation -- which is why the gate
now reads the rendered ExecStart rather than only asserting enable.

nix/host-modules/swarm-nats.nix

@@ -603,6 +603,27 @@ in
             listenAddress = "127.0.0.1";
             port = cfg.metricsPort;
             url = "http://127.0.0.1:${toString cfg.monitorPort}";
+
+            # ⚠️ NOT optional, despite the name. Upstream renders
+            # `-addr … -port … ${extraFlags} ${url}` and defaults
+            # `extraFlags` to the empty list, but the exporter REFUSES TO
+            # START without at least one collector: it exits 1 with
+            # "no Collectors specified". Shipped without this the unit logs
+            # `Started`, the process is gone milliseconds later, and the
+            # scrape is refused — measured, and invisible to evaluation
+            # because the empty list renders perfectly.
+            #
+            # Which three, and why not more: `varz` is the server itself
+            # (uptime, memory, slow consumers), `connz` is per-connection so
+            # a client that will not stay connected is visible, and `jsz`
+            # covers JetStream, which this swarm relies on for the status
+            # KV. The remaining collectors describe a clustered deployment
+            # this swarm does not have.
+            extraFlags = [
+              "-varz"
+              "-connz"
+              "-jsz=all"
+            ];
           };
 
           # A wrapper that includes upstream's rendered settings verbatim