nix(authelia): start with a disabled placeholder user when the user set is empty

authelia 4.39.20 exits at startup on `users: {}` ("users: non zero value
required"), and the first-boot unit seeded exactly that, so a swarm with
no users crash-looped authelia and answered 502 until `swarmctl user add`
ran.

The first-boot unit now writes one subject, `swarm.placeholder`, when
the users database is absent, empty, or exactly `users: {}`:

- `disabled: true` — authelia returns "user not found" for a disabled
  user before any password check (file_user_provider.go,
  CheckUserPassword).
- password: an argon2id digest with an all-zero key. It decodes (authelia
  rejects a non-digest at startup) and no known password hashes to it.
- the `.` keeps it out of agent names (`[a-z0-9-]`), and `swarmctl user
  add` refuses it as already existing. Neither writer removes users, and
  both round-trip `disabled`.

A file with any user in it is never touched.

The docs that described the crash-loop (sso.md, gateway.md, setup.md,
the sso-unavailable error page) now describe the placeholder; the
writers' load_store docs and the seed fixtures follow. module-eval
nats-authelia asserts the seed branch.

swarm-authelia-bridge/src/store.rs

@@ -216,9 +216,10 @@ fn validate(store: &UserStore) -> Result<()> {
 /// the same file we are about to write means we cannot clobber users we did
 /// not know about: we just read them.
 ///
-/// An absent or empty file is an empty store, not an error: first boot is a
-/// legitimate state, and the seed document authelia's own unit writes
-/// (`users: {}`) deserialises to exactly that with no special case.
+/// An absent or empty file is an empty store, not an error, and so is
+/// `users: {}`, with no special case. The `swarm-authelia` module seeds an
+/// empty database with one disabled placeholder subject, which loads like any
+/// other user.
 pub fn load_store(users_file: &Path) -> Result<UserStore> {
     match fs::read_to_string(users_file) {
         Ok(raw) if raw.trim().is_empty() => Ok(UserStore::default()),
@@ -313,15 +314,17 @@ mod tests {
     use super::*;
 
     /// What the `swarm-authelia` module's first-boot unit writes into
-    /// `users.yml` when there is no database yet.
-    ///
-    /// A test fixture rather than a production constant: nothing in this
-    /// binary writes a seed any more — the store deserialises whatever is
-    /// there and an absent file is an empty store. Keeping it `pub` in the
-    /// module would be a constant nothing reads, which is exactly the kind
-    /// of leftover that makes the next reader think the seed dance is still
-    /// load-bearing.
-    const SEED_USERS_FILE: &str = "users: {}";
+    /// `users.yml` when the user set is empty: one disabled placeholder.
+    /// A copy of `placeholderUsersFile` in
+    /// `nix/host-modules/swarm-authelia.nix`; a test fixture because nothing
+    /// in this binary writes a seed.
+    const SEED_USERS_FILE: &str = r"users:
+  swarm.placeholder:
+    displayname: placeholder (cannot log in)
+    email: swarm.placeholder@hyperhive.local
+    disabled: true
+    password: '$argon2id$v=19$m=65536,t=3,p=4$AAAAAAAAAAAAAAAAAAAAAA$AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
+";
 
     fn user(password: &str) -> User {
         User {
@@ -350,14 +353,24 @@ mod tests {
         }
     }
 
-    /// The document `swarm-authelia`'s first-boot unit writes must load as
-    /// an empty store with no special case — otherwise a fresh hive's very
-    /// first `EnsureAgentIdentity` fails on a file we wrote ourselves.
+    /// The document `swarm-authelia`'s first-boot unit writes must load with
+    /// no special case — otherwise a fresh hive's very first
+    /// `EnsureAgentIdentity` fails on a file we wrote ourselves — and its
+    /// placeholder must stay out of the roster and stay disabled through a
+    /// write.
     #[test]
-    fn the_first_boot_seed_loads_as_an_empty_store() {
+    fn the_first_boot_seed_loads_and_its_placeholder_stays_disabled() {
         let store: UserStore = serde_norway::from_str(SEED_USERS_FILE).expect("seed parses");
-        assert!(store.users.is_empty());
-        assert!(store.extra.is_empty());
+        assert_eq!(store.users.len(), 1);
+        assert!(agent_names(&store).is_empty());
+
+        let out = render_yaml(&store).expect("renders");
+        let back: UserStore = serde_norway::from_str(&out).expect("reparses");
+        assert_eq!(
+            back.users["swarm.placeholder"].extra.get("disabled"),
+            Some(&serde_norway::Value::Bool(true)),
+            "dropped after a write:\n{out}"
+        );
     }
 
     /// An argon2 digest is `$`, `=`, `,` and `/` — the reason a real