swarm: OIDC clients registered wherever authelia runs; nats + matrix secrets from bao

The three client registrations move into glue-{controller,nats,matrix}-oidc-client.nix,
gated only on deploy.authelia.enable and reading their ids from swarm.* options,
so the host running authelia registers every one of them whichever host runs
the service. The matrix callback is a new read-only swarm.matrix.sso.redirectUri,
read by both the homeserver's config and its client entry.

swarm-secret-publish now also publishes the queue's and the homeserver's minted
secrets to swarm/services/<id>/oidc/client. The queue host reads its responder's
secret there with swarm-bao-nats-auth-oidc under the responder's own leaf
(swarm-nats-auth role gains that one read path), and the homeserver's host with
swarm-bao-matrix-oidc under matrix-ctl's leaf (swarm-matrix-ctl role gains its
one read path). The host-file copies are gone: swarm-nats-auth-secrets now
delivers only the callout seeds and the store identity, and
hive-matrix-oidc-secret is removed. A fetch unit whose leaf is unset still
renders and fails naming the option pair.

Closes #4943

nix/host-modules/swarm-nats-service.nix

@@ -107,9 +107,9 @@ in
       default = "swarm-nats";
       description = ''
         OAuth2 client id the queue's authentication path identifies
-        itself with. Must match the `id` of the corresponding entry in
-        `services.hyperhive.swarm.authelia.oidc.clients` — which this
-        module contributes for you when both run on this host.
+        itself with. The host running authelia registers it, whichever
+        host runs the queue, and the queue's host reads its secret out of
+        the swarm secret store.
       '';
     };