glue: consumers' start-after-bao ordering moves into one glue module

Each store reader (forge's OIDC fetch and token publisher, matrix's OIDC
fetch, the hive collector's fetch, Grafana's OIDC fetch and admin password,
the queue's callout-xkey unit, the CI runner's token fetch, the swarm
collector's OIDC fetch) used to read `deploy.bao.enable` in its own module
to add `after`/`wants` on `container@<store machine>` and
`after`/`requires` on `swarm-bao-pki.service`. Per the #3742 ruling, that
cross-service read moves into glue-bao-readers-store-order.nix, which sets
the same edges when the store and the reader are both on this host and
restates each reader's own gate so no stub unit is rendered.

Rendered `after`/`wants`/`requires` are identical as sets to main on 16
fixtures, store here and elsewhere. New module-eval cases in existing
fixtures pin both arms.

Part of #3742.

nix/host-modules/glue-bao-readers-store-order.nix

@@ -0,0 +1,74 @@
+# Glue: where the store and one of its readers share a host, the reader waits
+# for the store's container and requires `swarm-bao-pki`, which mints the leaf
+# the reader logs in with.
+#
+# ONE PAIRING PER FILE — the store's container and PKI unit ← the readers that
+# log in to it, and nothing else. The waits on the store's policy units are
+# ./glue-bao-readers-policy-order.nix's.
+#
+# ⚠️ Gated on BOTH the store and that reader being here. Off the store's host
+# neither unit exists, and `Requires=` on an absent unit fails the job, so
+# there the reader's own start timeout bounds the attempt instead. On the
+# store's host without the reader, setting `systemd.services.<reader>.after`
+# would define a unit with no ExecStart, so each gate below restates the one
+# the reader's own module puts on it. A reader whose gate changes must change
+# here too.
+{
+  lib,
+  config,
+  ...
+}:
+let
+  hyperhiveCfg = config.services.hyperhive;
+  deployCfg = hyperhiveCfg.deploy;
+  baoDeploy = deployCfg.bao;
+  baoCfg = hyperhiveCfg.swarm.bao;
+  otel = hyperhiveCfg.otel;
+
+  havePair = cert: key: cert != null && key != null;
+
+  # Reader unit → the gate its own module defines it under.
+  readersHere = {
+    # ./hive-forge/default.nix
+    swarm-bao-forge-oidc = deployCfg.forgejo.enable;
+    swarm-bao-forge-publisher = deployCfg.forgejo.enable;
+    # ./hive-matrix.nix
+    swarm-bao-matrix-oidc = deployCfg.matrix.enable;
+    # ./otel.nix: `fetches`, the collector loading the file this unit writes
+    # under the hive's own leaf.
+    swarm-bao-hive-otel-oidc =
+      otel.enable
+      && hyperhiveCfg.hiveName != null
+      && havePair baoDeploy.clientCertFile baoDeploy.clientKeyFile
+      &&
+        otel.clientSecretFile
+        == "/var/lib/hive-otel-oidc/${hyperhiveCfg.swarm.authelia.hiveClientPrefix}${toString hyperhiveCfg.hiveName}.secret";
+    # ./swarm-grafana.nix
+    swarm-bao-grafana-oidc = deployCfg.grafana.enable;
+    swarm-bao-grafana-admin = deployCfg.grafana.enable;
+    # ./swarm-nats.nix
+    swarm-bao-nats-callout-xkey = deployCfg.nats.enable;
+    # ./swarm-ci-runner.nix
+    swarm-bao-ci-runner = deployCfg.ci-runner.enable;
+    # ./swarm-otel.nix
+    swarm-bao-otel-oidc =
+      deployCfg.swarm-otel.enable
+      && havePair baoDeploy.otelOidcClientCertFile baoDeploy.otelOidcClientKeyFile;
+  };
+
+  orderAfterStore =
+    reader: here:
+    lib.mkIf (baoDeploy.enable && here) {
+      systemd.services.${reader} = {
+        after = [
+          "swarm-bao-pki.service"
+          "container@${baoCfg.machine}.service"
+        ];
+        wants = [ "container@${baoCfg.machine}.service" ];
+        requires = [ "swarm-bao-pki.service" ];
+      };
+    };
+in
+{
+  config = lib.mkMerge (lib.mapAttrsToList orderAfterStore readersHere);
+}