nix(authelia): start with a disabled placeholder user when the user set is empty

authelia 4.39.20 exits at startup on `users: {}` ("users: non zero value
required"), and the first-boot unit seeded exactly that, so a swarm with
no users crash-looped authelia and answered 502 until `swarmctl user add`
ran.

The first-boot unit now writes one subject, `swarm.placeholder`, when
the users database is absent, empty, or exactly `users: {}`:

- `disabled: true` — authelia returns "user not found" for a disabled
  user before any password check (file_user_provider.go,
  CheckUserPassword).
- password: an argon2id digest with an all-zero key. It decodes (authelia
  rejects a non-digest at startup) and no known password hashes to it.
- the `.` keeps it out of agent names (`[a-z0-9-]`), and `swarmctl user
  add` refuses it as already existing. Neither writer removes users, and
  both round-trip `disabled`.

A file with any user in it is never touched.

The docs that described the crash-loop (sso.md, gateway.md, setup.md,
the sso-unavailable error page) now describe the placeholder; the
writers' load_store docs and the seed fixtures follow. module-eval
nats-authelia asserts the seed branch.

nix/module-eval/nats-authelia.nix

@@ -224,6 +224,20 @@ let
       name = "a consumer of authelia's host client-secret dir renders it from the deploy namespace";
       ok = lib.hasInfix "/var/lib/nixos-containers/swarm-authelia/var/lib/authelia-swarm/oidc-clients/" autheliaOldPath.systemd.services.swarm-nats-auth-secrets.script;
     }
+    {
+      # authelia exits at startup on `users: {}`, so an empty database, and a
+      # file holding exactly that document, must be replaced by the disabled
+      # placeholder rather than left for authelia to read.
+      name = "an empty authelia users database is seeded with the disabled placeholder";
+      ok =
+        let
+          s =
+            autheliaColocated.containers.swarm-authelia.config.systemd.services.authelia-swarm-secrets.script;
+        in
+        lib.hasInfix ''if [ ! -s "$users" ] || [ "$(cat "$users")" = "users: {}" ]; then'' s
+        && lib.hasInfix "-authelia-users-placeholder.yml \"$users\"" s
+        && !(lib.hasInfix ''echo "users: {}"'' s);
+    }
     {
       # Config NAMES the IdP; it never computes where the IdP is. Both arms
       # matter together: the address is the swarm's name on a hive that runs