swarm: OIDC clients registered wherever authelia runs; nats + matrix secrets from bao

The three client registrations move into glue-{controller,nats,matrix}-oidc-client.nix,
gated only on deploy.authelia.enable and reading their ids from swarm.* options,
so the host running authelia registers every one of them whichever host runs
the service. The matrix callback is a new read-only swarm.matrix.sso.redirectUri,
read by both the homeserver's config and its client entry.

swarm-secret-publish now also publishes the queue's and the homeserver's minted
secrets to swarm/services/<id>/oidc/client. The queue host reads its responder's
secret there with swarm-bao-nats-auth-oidc under the responder's own leaf
(swarm-nats-auth role gains that one read path), and the homeserver's host with
swarm-bao-matrix-oidc under matrix-ctl's leaf (swarm-matrix-ctl role gains its
one read path). The host-file copies are gone: swarm-nats-auth-secrets now
delivers only the callout seeds and the store identity, and
hive-matrix-oidc-secret is removed. A fetch unit whose leaf is unset still
renders and fails naming the option pair.

Closes #4943

docs/integrations/matrix.md

@@ -359,11 +359,13 @@ surprising behaviour:
 SSO is unconditional, so the three below are requirements of running a
 homeserver at all rather than of a setting:
 
-- **Set `deploy.matrix.sso.clientSecretFile`** — fails at eval, not at boot:
-  tuwunel reads its identity providers from the config file, so a
-  half-configured one can stop the homeserver from starting outright
-  rather than merely hiding a login button. On a host that also runs
-  the swarm's authelia it's wired up for you.
+- **Keep `deploy.matrix.sso.clientSecretFile` set** — it defaults to
+  `/var/lib/tuwunel-oidc/<client id>.secret` wherever the homeserver runs,
+  and `swarm-bao-matrix-oidc` writes the secret there from the swarm secret
+  store under matrix-ctl's leaf. A null fails at eval, not at boot: tuwunel
+  reads its identity providers from the config file, so a half-configured
+  one can stop the homeserver from starting outright rather than merely
+  hiding a login button.
 - **Set `swarm.authelia.url`** — without a provider URL there
   is nothing to discover against.
 - **Set `swarm.matrix.gatewayHost != null`** — the SSO callback URL is