swarm-authelia: let a client declare its token-endpoint auth method

tuwunel authenticates at the token endpoint with the secret in the POST
body. Authelia enforces the method a client is REGISTERED with rather
than accepting whichever one arrives, and its default is
client_secret_basic — so the matrix login completed, consent was
granted, and the very last hop failed:

  Client authentication failed ... The request was determined to be
  using token_endpoint_auth_method client_secret_post, however the
  OAuth 2.0 client registration does not allow this method.

The failure names neither the secret nor the redirect, and it lands
three layers from its cause, which is why it read as a credential
problem.

Adds a per-client tokenEndpointAuthMethod, null by default so every
existing client keeps authelia default (forgejo authenticates with
basic and is unaffected), and sets client_secret_post on the matrix
client only.

nix/host-modules/hive-matrix.nix

@@ -665,6 +665,13 @@ in
         id = cfg.sso.clientId;
         description = "HyperHive matrix";
         redirectUris = [ ssoCallbackUrl ];
+        # tuwunel authenticates at the token endpoint by putting the
+        # secret in the POST body. Authelia enforces the *registered*
+        # method rather than accepting whichever one arrives, and its
+        # default is `client_secret_basic` — so without this the browser
+        # flow completes, consent is granted, and the very last hop fails
+        # with a 401 that names neither the secret nor the redirect.
+        tokenEndpointAuthMethod = "client_secret_post";
       }
     ];