nix(authelia): start with a disabled placeholder user when the user set is empty

authelia 4.39.20 exits at startup on `users: {}` ("users: non zero value
required"), and the first-boot unit seeded exactly that, so a swarm with
no users crash-looped authelia and answered 502 until `swarmctl user add`
ran.

The first-boot unit now writes one subject, `swarm.placeholder`, when
the users database is absent, empty, or exactly `users: {}`:

- `disabled: true` — authelia returns "user not found" for a disabled
  user before any password check (file_user_provider.go,
  CheckUserPassword).
- password: an argon2id digest with an all-zero key. It decodes (authelia
  rejects a non-digest at startup) and no known password hashes to it.
- the `.` keeps it out of agent names (`[a-z0-9-]`), and `swarmctl user
  add` refuses it as already existing. Neither writer removes users, and
  both round-trip `disabled`.

A file with any user in it is never touched.

The docs that described the crash-loop (sso.md, gateway.md, setup.md,
the sso-unavailable error page) now describe the placeholder; the
writers' load_store docs and the seed fixtures follow. module-eval
nats-authelia asserts the seed branch.

docs/getting-started/setup.md

@@ -57,8 +57,8 @@ What the granter is, why it's root-equivalent, and the store's TLS:
 
 ## 2 · Your SSO account
 
-_On the host running authelia._ Authelia refuses to start with no users,
-so until this runs `auth.<swarm.domain>` answers `502 Bad Gateway`.
+_On the host running authelia._ Until this runs, `auth.<swarm.domain>` serves
+a login page that refuses everyone: its only subject is a disabled placeholder.
 
 ```bash
 swarmctl user add mara --display-name Mara --email mara@example.com --group admins

docs/networking/gateway.md

@@ -20,7 +20,7 @@ This host's nginx fronts the hyperhive web surfaces running on it — next to hi
 Only the host that **runs** authelia declares the authelia vhost, not every hive that uses it — a client hive knows the swarm's `authelia.url` but must not answer for a name it doesn't serve. Its server name is exactly `swarm.authelia.domain`: authelia validates `authelia_url ⊂ session cookie domain` at startup, so a near-miss is a container that refuses to boot. It carries no `auth_basic` — the login page must not sit behind the login mechanism it replaces — and sets the four `X-Forwarded-{Proto,Host,Uri,For}` headers, since authelia decides by the *original* request rather than the hop it sees.
 
 <!-- vale write-good.Passive = NO -->
-⚠️ **A `502` from this vhost typically means authelia has no users yet, not that the proxy is misconfigured.** Authelia treats an empty user store as a fatal startup error, so an enabled-but-unbootstrapped swarm crash-loops the container while the vhost in front of it works perfectly. Check `journalctl -M swarm-authelia -u authelia-swarm` before suspecting anything here; the bootstrap step is in [`swarm/sso.md`](../swarm/sso.md).
+⚠️ **A `502` from this vhost means authelia itself isn't answering, not that the proxy is misconfigured.** Check `journalctl -M swarm-authelia -u authelia-swarm` before suspecting anything here. A swarm with no users of its own answers with a login page that refuses everyone; the first account is created in [`swarm/sso.md`](../swarm/sso.md).
 <!-- vale write-good.Passive = YES -->
 
 Per-agent UIs stay sub-path, forge and matrix get sub-domains — see

docs/swarm/sso.md

@@ -18,25 +18,24 @@ name all follow `deploy.authelia`, so there is nothing to turn on
 separately. (Details, including why a client hive must not declare that
 vhost: [`../networking/gateway.md`](../networking/gateway.md).)
 
-**Authelia doesn't start until at least one user exists.** This module
-generates the user store empty — deliberately, since seeding a default
-account would put a credential in a config file — but authelia validates
-it at startup and treats "no users" as fatal:
+**Nobody can log in until the first user exists.** authelia exits at
+startup on an empty user set:
 
 ```
 error reading the authentication database: could not validate the schema:
   users: non zero value required
 ```
 
-It then exits 1 and systemd restarts it, so a swarm the operator has
-enabled but not bootstrapped shows a **crash-looping unit** and `502 Bad
-Gateway` from the vhost — not a login page with nobody able to use it.
-The gateway is working in that state; the upstream isn't up.
+While the set is empty this module writes one placeholder subject,
+`swarm.placeholder`, that authelia accepts and that can't log in: it's
+`disabled: true`, and its password digest has an all-zero key that no
+known password hashes to. authelia starts and serves its login page, and
+refuses every login. The placeholder stays in `users.yml` once real
+users exist, shows up in `swarmctl user list`, and `swarmctl user add`
+refuses its name.
 
 ⚠️ The step below is **required to finish the install**, not an
-optional first-login convenience. Run it before concluding anything is
-wrong with the proxy: a 502 here means "no users yet" far more often
-than it means a routing fault.
+optional first-login convenience.
 
 Add the first subject on the host running authelia: