nix: derive hive identities and the token endpoint from the swarm, not this host

Two swarm-wide facts were being read off this machine's deploy set, so the
answer differed between two hosts of one swarm:

  - `swarm.authelia.oidc.hiveIdentities` defaulted to `deploy.nats.enable`,
    so whether a hive gets an identity at all depended on whether the IdP
    host happened to also run the queue. It is on by default now: a swarm's
    hives have identities, and the clients are inert until used.

  - `swarm.statusPublish.tokenEndpoint` defaulted through `queueLocal`
    (`deploy.nats.enable && deploy.authelia.enable`), so a hive that was not
    the swarm host had no token endpoint even when the swarm's IdP was
    reachable and named. It follows `swarm.authelia.url` now — the same
    derivation `swarm-controller.nix`'s own `queue.tokenEndpoint` already
    uses, which is correct for a remote provider.

`deploy.nix:1-30` is what makes this a rule rather than a preference:
`swarm.*` is "identical on every host, byte for byte" and `deploy.*` is
"necessarily different on every host". A swarm value derived from a deploy
value cannot satisfy both.

The all-or-nothing status-publish assertion follows: the token endpoint is
no longer one of the coordinates that says this hive publishes — every hive
in a swarm with an IdP has one — so the two per-host coordinates are what
must agree, and they now require the endpoint rather than being counted
beside it.

`queueLocal` itself stays for the three remaining host-local addresses
(`natsUrl`, `clientSecretFile`, `agentNatsUrl`): each of those is a
`deploy.*` value that genuinely differs per host.

Closes #4048

nix/host-modules/swarm-otel.nix

@@ -626,10 +626,9 @@ in
         };
     };
 
-    # Turning on the identities this tier authenticates against, which the
-    # option exists to allow: its own description names this module as the
-    # second consumer, so the queue is not a prerequisite for authenticated
-    # telemetry.
+    # The identities this tier authenticates against. Stated rather than
+    # assumed: the option is an operator's to turn off, and this tier does
+    # not work without it.
     services.hyperhive.swarm.authelia.oidc.hiveIdentities = true;
 
     # The collector's own identity, for the other direction: the hive