fix: let the secret-delivery oneshots outlive their own bounded wait

Three host units poll up to 120s for a secret authelia mints on its first
boot, and all three are `Type=oneshot` with no `TimeoutStartSec`. systemd's
`DefaultTimeoutStartSec` is 90s, so it kills them at 90 — before the script
reaches its own `exit 1` and names the file that never appeared.

The wait itself is fine; what's lost is the diagnosis. On a fresh hive the
operator gets a bare start-timeout instead of "authelia has not minted
<path>", several layers from the container that was actually slow.

Found while writing the same unit for Grafana, where the timeout is set —
so this is the existing three catching up with it, not a new pattern.

nix/host-modules/hive-forge/default.nix

@@ -1086,6 +1086,10 @@ in
         Type = "oneshot";
         RemainAfterExit = true;
         SyslogIdentifier = "hive-forge-oidc-secret";
+        # Longer than the 120s bounded wait below. `DefaultTimeoutStartSec`
+        # is 90s, so without this systemd kills the unit at 90 — before it
+        # can emit the message naming the file it was waiting for.
+        TimeoutStartSec = "180s";
       };
       path = [ pkgs.coreutils ];
       script = ''
@@ -1139,6 +1143,10 @@ in
         Type = "oneshot";
         RemainAfterExit = true;
         SyslogIdentifier = "hive-forge-swarm-controller-token";
+        # Longer than the 120s bounded wait below. `DefaultTimeoutStartSec`
+        # is 90s, so without this systemd kills the unit at 90 — before it
+        # can emit the message naming the file it was waiting for.
+        TimeoutStartSec = "180s";
       };
       path = [ pkgs.coreutils ];
       script = ''

nix/host-modules/hive-matrix.nix

@@ -710,6 +710,13 @@ in
         Type = "oneshot";
         RemainAfterExit = true;
         SyslogIdentifier = "hive-matrix-oidc-secret";
+        # Longer than the 120s bounded wait below, and that is the whole
+        # point: `DefaultTimeoutStartSec` is 90s, so without this systemd
+        # kills the unit at 90 — before it can emit the message naming the
+        # file it was waiting for. The failure then reads as a timeout with
+        # no cause rather than "authelia has not minted <path>", which is
+        # the one line that makes a fresh-hive SSO stall diagnosable.
+        TimeoutStartSec = "180s";
       };
       path = [ pkgs.coreutils ];
       script = ''