swarm: OIDC clients registered wherever authelia runs; nats + matrix secrets from bao

The three client registrations move into glue-{controller,nats,matrix}-oidc-client.nix,
gated only on deploy.authelia.enable and reading their ids from swarm.* options,
so the host running authelia registers every one of them whichever host runs
the service. The matrix callback is a new read-only swarm.matrix.sso.redirectUri,
read by both the homeserver's config and its client entry.

swarm-secret-publish now also publishes the queue's and the homeserver's minted
secrets to swarm/services/<id>/oidc/client. The queue host reads its responder's
secret there with swarm-bao-nats-auth-oidc under the responder's own leaf
(swarm-nats-auth role gains that one read path), and the homeserver's host with
swarm-bao-matrix-oidc under matrix-ctl's leaf (swarm-matrix-ctl role gains its
one read path). The host-file copies are gone: swarm-nats-auth-secrets now
delivers only the callout seeds and the store identity, and
hive-matrix-oidc-secret is removed. A fetch unit whose leaf is unset still
renders and fails naming the option pair.

Closes #4943

nix/host-modules/swarm-otel.nix

@@ -132,7 +132,7 @@ let
   # Upstream's collector unit runs with `DynamicUser = true`, and the
   # prometheus receiver opens `client_secret_file` ITSELF, at runtime, as that
   # user — so there is no stable uid to hand a file to, and the root-owned
-  # 0400 shape `hive-matrix-oidc-secret` delivers to would be unreadable.
+  # 0400 shape `swarm-bao-matrix-oidc` delivers to would be unreadable.
   # (Matrix gets away with it because `LoadCredential` reads the file as root
   # before the sandbox exists, and tuwunel never opens that path itself.)
   #