docs/swarm: the swarm collector need not share a host with authelia

This PR makes a swarm collector on a host with neither store — and no
authelia — an expressible deployment; `module-eval`'s `otelRemoteAuthelia`
case is exactly that. `secrets.md` still asserted the opposite in two
places, and one of them was the "hive elsewhere" column reading `n/a`.

The delivery unit is the convenience for the co-located case, not the
definition of it: whether the collector authenticates follows the
credential, never another service's placement.

docs/swarm/secrets.md

@@ -51,7 +51,7 @@ neither is a renaming of the other.
 | authelia OIDC issuer key (RSA) | same unit | `/var/lib/authelia-swarm/oidc-issuer.key` | same — relying parties verify against the **public** half at `/jwks.json` |
 | OIDC client secret, plaintext half | `authelia crypto hash generate --random` | `/var/lib/authelia-swarm/oidc-clients/<id>.secret` | operator provides the file and names it in whichever option reads it — `sso.clientSecretFile` for a service, `otel.clientSecretFile` for the hive's telemetry collector |
 | OIDC client secret, digest half | the same mint | `oidc-clients/<id>.digest` | authelia's own half; merged at runtime via `settingsFiles` |
-| the swarm collector's copy of its OIDC secret | `swarm-otel-oidc-secret.service` copies it from authelia's tree | `/var/lib/swarm-otel-oidc/<id>.secret` inside the `swarm-otel` container | n/a — this collector runs on the swarm's service host, beside authelia |
+| the swarm collector's copy of its OIDC secret | `swarm-otel-oidc-secret.service` copies it from authelia's tree, **when authelia runs on this host** | `/var/lib/swarm-otel-oidc/<id>.secret` inside the `swarm-otel` container | operator provides the file and names it in `swarm.otel.clientSecretFile` — the collector need not share a host with authelia |
 | authelia subject store | `swarmctl` and `swarm-authelia-bridge` | `users.yml` — one file, read and written by both | `swarmctl`, on the host that runs authelia |
 | wireguard private key | **the operator** — `wg genkey` | whatever `swarm.wireguard.privateKeyFile` names | always operator-provided; nothing generates this for you |
 | queue auth-callout nkeys (user seed + account seed) | `swarm-nats-callout-keys` first-boot unit, when `nats.autoGenerateCallout` is set | `/var/lib/swarm-nats-callout/{callout-user,issuer}.seed`, `0600` | operator mints both with `nk` and names them in `nats.calloutUserSeedFile` / `nats.calloutIssuerSeedFile` |
@@ -77,11 +77,16 @@ placed by `swarm-otel-oidc-secret.service` and lands at
 homeserver rows below, and for the same reason: the container that mints the
 secret is not the container that reads it.
 
-There is no operator-provided variant of that one, and that is a property of
+The copy is only made when authelia is enabled **on this host** and something
-where it runs rather than an omission: the swarm's collector lives on the host
+published is being scraped; otherwise no secret is needed and none is placed.
-that runs the swarm's services, which is the host that runs authelia. The copy
+
-is only made when authelia is enabled here and something published is being
+⚠️ **Do not read that delivery unit as the only way this collector is fed.**
-scraped; otherwise no secret is needed and none is placed.
+Whether it authenticates follows the *credential*, never another service's
+placement: a swarm collector may run on a host that holds neither store and no
+authelia, and then the secret is an ordinary operator-provided file named in
+`services.hyperhive.swarm.otel.clientSecretFile` — the same shape as the hive
+collector's row above. The copy unit is the convenience for the co-located case,
+not the definition of the case.
 
 ### Minting the queue's callout nkeys