swarm UI: an alerts page, read by the controller with a Viewer Grafana token from bao

swarm-bao-grafana-controller-token, on the host that runs Grafana, logs in
to Grafana's API over its socket as the built-in admin (the password
swarm-bao-grafana-admin minted, #5138) and keeps a `swarm-controller`
service account that is an enabled Viewer. It mints a token for that
account and writes it to bao at
swarm/controller/swarm-controller/grafana/token under Grafana's leaf. A
ten-minute timer runs it again. The unit keeps a stored token Grafana
accepts. If Grafana refuses the stored token with 401, or bao holds
none, the unit deletes every token of the account and mints a new one.
Grafana's grant gains create/read/update on that leaf, and the
controller's gains read.

swarm-controller serves GET /api/alerts from Grafana's
/api/prometheus/grafana/api/v1/alerts. It reads the token from bao,
keeps it in memory, and re-reads bao once on a 401. The HTTP client has
5s connect and 15s request timeouts. Any failure is a 503 that names its
cause. swarm-ui gets an /alerts page listing them, built the same way as
the hives page.

This is option (c) on #5129, the operator's choice.

nix/host-modules/swarm-controller.nix

@@ -811,6 +811,11 @@ in
         # separated: a matrix user id cannot contain a space. Consumed by
         # swarm-controller/src/matrix_account/operator_admin.rs.
         SWARM_CONTROLLER_MATRIX_ADMIN_SYNC_IGNORE_USERS = lib.concatStringsSep " " matrixCfg.adminSync.ignoreUsers;
+        # Where `GET /api/alerts` reads alerts (swarm-controller/src/alerts.rs).
+        # Every swarm has one Grafana, reached by name wherever it runs. The
+        # token is in the store, written by `swarm-bao-grafana-controller-token`
+        # on Grafana's host.
+        SWARM_CONTROLLER_GRAFANA_URL = "https://${swarmCfg.grafana.domain}";
       }
       // queueEnv
       // forgeEnv