swarm-grafana: one delivery route for the OIDC client secret

The previous commit left two delivery paths and a three-way gate:
`swarm-grafana-oidc-secret.service` copied authelia's minted plaintext
out of its host tree wherever the two were co-located,
`swarm-bao-grafana-oidc.service` read the same value from the swarm
secret store wherever they were not, and `ssoConfigured && (ssoLocal ||
haveClientIdentity)` decided whether Grafana got an OIDC block at all.

Delete the co-located path. The store reader is now THE delivery unit,
in every deployment — the publisher on authelia's host writes
`swarm/services/<id>/oidc/client` whether the reader is a network away
or in the container next door. The ruling behind it: the store exists so
a host holds ONE out-of-band secret, its client certificate, and reads
everything else with it. Skipping the store when the producer happens to
be local saves a round trip and costs a second delivery unit, a second
way for the file to be wrong, and a gate to choose between them.

The gate goes too, and both of its questions become assertions, scoped
to hosts that run Grafana:

- `swarm.authelia.url` must be set. `auth.disable_login_form` is
  unconditional — Grafana ships an admin/admin account on a public
  vhost — so dropping the OIDC block when the swarm names no IdP
  produced a container with no SSO and no password box, silently. An
  eval-time refusal naming the option is the only report that reaches
  anyone, the shape swarm-nats.nix already uses for the same option.
- `deploy.bao.clientCertFile` / `clientKeyFile` must be set. This
  replaces a warning that nothing reads back, and its message names both
  options and where the leaf comes from.

Fixtures follow. `grafanaWithAuthelia` gains the cert pair, because a
co-located host is a store reader like any other. The old
`grafanaRemoteAutheliaNoIdentity` is kept rather than deleted, renamed
`grafanaNoIdentity`: the shape is still reachable, only its deliverable
changed from silence to a refusal, and an arm now reads that refusal
back. Its mirror `grafanaNoSso` covers the other assertion, each fixture
wrong in exactly one way so an arm can name which refusal fired. Every
positive keeps an explicit negative — the one-delivery-unit arm asserts
the deleted unit is absent in both topologies rather than merely that
the store reader is present.

Refs #4234

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

nix/host-modules/swarm-secret-publisher.nix

@@ -1,6 +1,13 @@
 # The unit that copies authelia's minted OIDC client secrets into the swarm's
-# secret store, so whoever needs one without hosting authelia can read it: a
-# hive its agents' credential, a swarm service its own.
+# secret store, so whoever needs one can read it there: a hive its agents'
+# credential, a swarm service its own.
+#
+# ⚠️ "Whoever", including a reader on THIS host. A swarm service's secret goes
+# into the store even when the service runs beside authelia, because its
+# reader fetches it from the store in every deployment — ./swarm-grafana.nix
+# states the ruling that made that the only route. Publishing "only when the
+# reader is elsewhere" would be a second shape of this unit, gated on a fact
+# about another host, to save a round trip on the one host that can afford it.
 #
 # ⚠️ IT RUNS WHERE AUTHELIA DOES, and that is the whole reason it exists as a
 # separate thing. `deploy.authelia.hostClientSecretDir`'s own description says
@@ -70,7 +77,8 @@ in
       description = ''
         Publish the OIDC client secrets this host mints into the swarm's
         secret store, so a hive that does not run authelia can read its
-        agents' credential and a swarm service elsewhere can read its own.
+        agents' credential and a swarm service can read its own — from
+        wherever it runs, this host included.
 
         Defaults to whether this host mints them, which is the only half of
         the question that is a property of *this* host.
@@ -82,10 +90,11 @@ in
         publishing nothing. Whether the wiring is complete is the client
         identity's job (see `baoClientCertFile`), not this option's.
 
-        Turning it off leaves every non-co-located hive without a delivery
-        path, which is the state this exists to end — so the honest reason
-        to set it false is a deployment delivering those secrets by some
-        other mechanism it owns.
+        Turning it off leaves every hive but this one without its agents'
+        credential, and the swarm's Grafana without any login at all — its
+        secret has exactly one route and this is the producer's end of it. So
+        the honest reason to set it false is a deployment delivering those
+        secrets by some other mechanism it owns.
       '';
     };