swarmctl: --swarm works after the subcommand, takes a bare domain, and login defaults to the host's swarm

`swarmctl login --swarm X` failed with "unexpected argument", and
`login --help` listed no `--swarm`: the flag was only accepted before the
verb. `--swarm` and `--ca-file` are now global, so they parse on either side
of the subcommand and show in every subcommand's help.

`--swarm` / `SWARMCTL_SWARM` accept a bare domain and prepend `https://`.
A value with a scheme is parsed as before, so `http://` is still refused.

On a swarm-controller host, the swarmctl wrapper sets
`SWARMCTL_LOGIN_DEFAULT_SWARM=https://<swarm.domain>` (`--set-default`).
Only `login` reads it, after `--swarm` and `SWARMCTL_SWARM`. The wrapper
does not set `SWARMCTL_SWARM`: that would send every socket verb (agent
create, schedule, inference, forge) through the gateway and make each need
a login. Other verbs resolve exactly as before.

No CA file is wired. The only CA material the module names is the
controller's assembled trust bundle (system CAs plus the hive anchor).
`--ca-file` hands every certificate in it to rustls-platform-verifier as
an extra root, and that fails the whole client on any one it cannot
parse, so pointing it at the system CAs is a risk nothing here can test.
The controller daemon trusts the same CA through `SSL_CERT_FILE`, which
skips unparsable certificates; using that for swarmctl is left open.

Machines that are not swarm-controller hosts (an operator laptop) get no
default; that case waits on an answer in the issue.

Fixes #5239

nix/host-modules/swarm-controller.nix

@@ -145,6 +145,14 @@ let
   swarmDomain = config.services.hyperhive.swarm.domain;
   matrixCfg = config.services.hyperhive.swarm.matrix;
 
+  # Which swarm `swarmctl login` logs in to when given none: this host's own.
+  # Read by `login` alone. `SWARMCTL_SWARM` would also move every socket verb
+  # onto the gateway, where each needs a login. A default, so an operator's
+  # own value still wins.
+  loginDefaultEnv = lib.optionalAttrs (swarmDomain != null) {
+    SWARMCTL_LOGIN_DEFAULT_SWARM = "https://${swarmDomain}";
+  };
+
   # The controller's forge client speaks TLS to `https://${forgeCfg.domain}`,
   # which the gateway serves with a leaf issued by the secret store's `pki`
   # mount, whose root is generated inside the store at runtime, so nothing
@@ -306,6 +314,9 @@ let
           lib.mapAttrsToList (name: value: "--set ${name} ${lib.escapeShellArg value}") (
             autheliaEnv // controllerSocketEnv
           )
+          ++ lib.mapAttrsToList (
+            name: value: "--set-default ${name} ${lib.escapeShellArg value}"
+          ) loginDefaultEnv
         )
       }
     '';