swarm: OIDC clients registered wherever authelia runs; nats + matrix secrets from bao

The three client registrations move into glue-{controller,nats,matrix}-oidc-client.nix,
gated only on deploy.authelia.enable and reading their ids from swarm.* options,
so the host running authelia registers every one of them whichever host runs
the service. The matrix callback is a new read-only swarm.matrix.sso.redirectUri,
read by both the homeserver's config and its client entry.

swarm-secret-publish now also publishes the queue's and the homeserver's minted
secrets to swarm/services/<id>/oidc/client. The queue host reads its responder's
secret there with swarm-bao-nats-auth-oidc under the responder's own leaf
(swarm-nats-auth role gains that one read path), and the homeserver's host with
swarm-bao-matrix-oidc under matrix-ctl's leaf (swarm-matrix-ctl role gains its
one read path). The host-file copies are gone: swarm-nats-auth-secrets now
delivers only the callout seeds and the store identity, and
hive-matrix-oidc-secret is removed. A fetch unit whose leaf is unset still
renders and fails naming the option pair.

Closes #4943

nix/host-modules/swarm-controller.nix

@@ -301,7 +301,8 @@ let
     OTEL_EXPORTER_OTLP_ENDPOINT = "https://${otelSwarmCfg.domain}/${otelSwarmCfg.producerName}";
     # Checked by `swarm-otel.nix`'s `oidc/${producerName}` authenticator
     # against exactly this controller's own registered audience (see the
-    # `audience = [ queueClientId ]` client entry below) — the two have
+    # `audience = [ queueClientId ]` client entry in
+    # ./glue-controller-oidc-client.nix) — the two have
     # to name the same value or the exporter mints a token the receiver
     # was never told to accept.
     SWARM_CONTROLLER_OTEL_AUDIENCE = queueClientId;
@@ -360,9 +361,10 @@ in
       default = "swarm-controller";
       description = ''
         The OAuth2 client id the controller presents to the swarm queue.
-        Read-only: it is what this module registers, published so the
-        auth-callout responder can be told which client may read every
-        hive's key without repeating the string.
+        Read-only: it is the client the host running authelia registers,
+        whichever host runs the controller, published so the auth-callout
+        responder can be told which client may read every hive's key without
+        repeating the string.
 
         The responder decides that from a client id, and a client id it
         does not recognise is **denied**. A denial reaches a NATS client
@@ -704,34 +706,6 @@ in
     # exactly what it must not inherit.
     environment.systemPackages = [ swarmctlConfigured ];
 
-    # One declaration, two readers — the controller knows which client id it
-    # authenticates under, so making the operator restate it in authelia's
-    # client list would be a second source of truth for a string whose
-    # mismatch is an opaque 401 from the token endpoint. Same shape as the
-    # queue's own client declaration.
-    services.hyperhive.swarm.authelia.oidc.clients = lib.mkIf deployCfg.authelia.enable [
-      {
-        id = queueClientId;
-        description = "HyperHive swarm controller";
-        # `client_credentials`: a daemon authenticating as itself, with
-        # nobody to redirect. Declared rather than inferred from an empty
-        # redirect list, because authelia permits only the grants a client
-        # names and an omitted `grant_types` means authorization-code alone.
-        kind = "machine";
-        # Its own id as its own permitted audience — same "client's own id
-        # is the value it may ask for" shape `swarm-authelia.nix`'s
-        # `hiveClients` uses, just self-referential instead of prefixed:
-        # this controller is not a hive (see `queueClientId`'s own doc
-        # comment), so it has no `hiveClientPrefix` name to reuse. This is
-        # what lets `vcs_metrics::authenticated_http_client()` mint a token
-        # for `SWARM_CONTROLLER_OTEL_AUDIENCE` and have `swarm-otel.nix`'s
-        # `oidc/swarm` authenticator (which checks for this same id) accept
-        # it — registering here without requesting there, or the reverse,
-        # both fail as a healthy-looking 401 several layers from this line.
-        audience = [ queueClientId ];
-      }
-    ];
-
     # A controller without a queue is not a lighter controller, it is a
     # broken one: `/api/hives/status` reads the KV, so its whole aggregate
     # half is off. The operator's rule is that the controller needs a queue