keep each hive's otel oidc secret on /run, not /var/lib

nix/host-modules/lib/hive-otel-secret.nix

@@ -0,0 +1,22 @@
+# Where `swarm-bao-hive-otel-oidc` lands this hive's OIDC client secret on
+# the host, and where it sat before it moved. Spelled once because
+# ../otel.nix, ../glue-hive-otel-authelia.nix and
+# ../glue-bao-readers-store-order.nix each compare `otel.clientSecretFile`
+# against it to decide whether the fetch unit exists; a copy that drifts makes
+# that comparison false and the secret stops refreshing.
+#
+# `path` is on /run (tmpfs): the secret never reaches persistent disk and the
+# unit fetches it again after a reboot.
+#
+# Pure function — NOT a NixOS module. Call it from a module's `let`:
+#
+#   hiveOtelSecret = import ./lib/hive-otel-secret.nix { inherit (cfg) hiveClientPrefix hiveName; };
+{ hiveClientPrefix, hiveName }:
+let
+  file = "${hiveClientPrefix}${toString hiveName}.secret";
+in
+{
+  dir = "/run/hive-otel-oidc";
+  path = "/run/hive-otel-oidc/${file}";
+  legacyPath = "/var/lib/hive-otel-oidc/${file}";
+}