nix: run the forge on one host per swarm (deploy.forgejo.enable)

Every hive with hyperhive enabled ran its own hive-forge container, and
its gateway answered forge.<swarm> with its own bridge IP, so on a
multi-host swarm each hive talked to its own forge.

deploy.forgejo.enable defaults to false and allSwarmServices sets it with
mkDefault, like authelia and bao; singleHostSwarm gets it through that.
The forge's OIDC client moves to a glue module gated on authelia, so a
split authelia/forge swarm still registers it. CI now requires the forge
on the same host, and the controller's forgeTokenFile defaults to null
where the forge is not.

Closes #4705
Refs #3782

nix/host-modules/default.nix

@@ -3,10 +3,11 @@
 # the package/source wiring; see flake.nix). One import covers
 # everything; `services.hyperhive.enable = true` turns the stack on.
 #
-# The forge is mandatory — hive-c0re mirrors every agent's applied
+# Every swarm needs the forge — hive-c0re mirrors every agent's applied
 # config repo into it and it's the canonical store for the meta flake
-# + `internal/*` repos, so there's no enable toggle; it deploys with
-# hyperhive itself. hive-matrix is opt-in (off by default). All
+# + `internal/*` repos — but only the host with `deploy.forgejo.enable`
+# runs it (derived from `deploy.allSwarmServices`, see
+# ./swarm-required-services.nix). hive-matrix is opt-in (off by default). All
 # subsystems rely on `services.hyperhive.domain`, which is required
 # (asserted in hive-network.nix) whenever hyperhive is enabled.
 {
@@ -26,6 +27,7 @@
     ./glue-bao-readers-policy-order.nix
     ./glue-bao-tls.nix
     ./glue-controller-bao-identity.nix
+    ./glue-forge-oidc-client.nix
     ./glue-grafana-oidc-client.nix
     ./glue-matrix-bao-token.nix
     ./glue-matrix-ctl-bao-identity.nix