nix(authelia): start with a disabled placeholder user when the user set is empty

authelia 4.39.20 exits at startup on `users: {}` ("users: non zero value
required"), and the first-boot unit seeded exactly that, so a swarm with
no users crash-looped authelia and answered 502 until `swarmctl user add`
ran.

The first-boot unit now writes one subject, `swarm.placeholder`, when
the users database is absent, empty, or exactly `users: {}`:

- `disabled: true` — authelia returns "user not found" for a disabled
  user before any password check (file_user_provider.go,
  CheckUserPassword).
- password: an argon2id digest with an all-zero key. It decodes (authelia
  rejects a non-digest at startup) and no known password hashes to it.
- the `.` keeps it out of agent names (`[a-z0-9-]`), and `swarmctl user
  add` refuses it as already existing. Neither writer removes users, and
  both round-trip `disabled`.

A file with any user in it is never touched.

The docs that described the crash-loop (sso.md, gateway.md, setup.md,
the sso-unavailable error page) now describe the placeholder; the
writers' load_store docs and the seed fixtures follow. module-eval
nats-authelia asserts the seed branch.

docs/getting-started/setup.md

@@ -57,8 +57,8 @@ What the granter is, why it's root-equivalent, and the store's TLS:
 
 ## 2 · Your SSO account
 
-_On the host running authelia._ Authelia refuses to start with no users,
-so until this runs `auth.<swarm.domain>` answers `502 Bad Gateway`.
+_On the host running authelia._ Until this runs, `auth.<swarm.domain>` serves
+a login page that refuses everyone: its only subject is a disabled placeholder.
 
 ```bash
 swarmctl user add mara --display-name Mara --email mara@example.com --group admins