nix(authelia): start with a disabled placeholder user when the user set is empty

authelia 4.39.20 exits at startup on `users: {}` ("users: non zero value
required"), and the first-boot unit seeded exactly that, so a swarm with
no users crash-looped authelia and answered 502 until `swarmctl user add`
ran.

The first-boot unit now writes one subject, `swarm.placeholder`, when
the users database is absent, empty, or exactly `users: {}`:

- `disabled: true` — authelia returns "user not found" for a disabled
  user before any password check (file_user_provider.go,
  CheckUserPassword).
- password: an argon2id digest with an all-zero key. It decodes (authelia
  rejects a non-digest at startup) and no known password hashes to it.
- the `.` keeps it out of agent names (`[a-z0-9-]`), and `swarmctl user
  add` refuses it as already existing. Neither writer removes users, and
  both round-trip `disabled`.

A file with any user in it is never touched.

The docs that described the crash-loop (sso.md, gateway.md, setup.md,
the sso-unavailable error page) now describe the placeholder; the
writers' load_store docs and the seed fixtures follow. module-eval
nats-authelia asserts the seed branch.

swarmctl/src/main.rs

@@ -570,9 +570,10 @@ fn publish(paths: &Paths, store: &mut UserStore) -> Result<()> {
 /// Reading the same file we are about to write means we cannot clobber users
 /// we did not know about: we just read them.
 ///
-/// An absent or empty file is an empty store, not an error. First boot is a
-/// legitimate state, and the seed document authelia's own unit writes
-/// (`users: {}`) deserialises to exactly that with no special case.
+/// An absent or empty file is an empty store, not an error, and so is
+/// `users: {}`, with no special case. The `swarm-authelia` module seeds an
+/// empty database with one disabled placeholder subject, which loads like any
+/// other user.
 fn load_store(users_file: &Path) -> Result<UserStore> {
     match fs::read_to_string(users_file) {
         Ok(raw) if raw.trim().is_empty() => Ok(UserStore::default()),
@@ -963,10 +964,10 @@ mod tests {
         fs::write(&users_file, "users: {}\n").expect("seed");
         assert!(
             load_store(&users_file)
-                .expect("the seed loads")
+                .expect("`users: {}` loads")
                 .users
                 .is_empty(),
-            "the first-boot seed is an empty store, with no special case"
+            "`users: {{}}` is an empty store, with no special case"
         );
 
         fs::remove_dir_all(&dir).ok();

swarmctl/src/users.rs

@@ -675,12 +675,12 @@ users:
     /// store claimed to be canonical. There is no overwrite to gate now: the
     /// file is read before it is written.
     ///
-    /// What still has to hold is that the first-boot seed and a zero-byte
-    /// file both mean "no users yet" rather than an error, so a fresh
-    /// deployment is not stranded.
+    /// What has to hold is that `users: {}` and a zero-byte file both mean
+    /// "no users" rather than an error, so a deployment holding either is
+    /// not stranded.
     #[test]
-    fn the_first_boot_seed_and_an_empty_file_both_mean_no_users() {
-        let seeded: UserStore = serde_norway::from_str("users: {}").expect("the seed parses");
+    fn an_empty_user_set_and_an_empty_file_both_mean_no_users() {
+        let seeded: UserStore = serde_norway::from_str("users: {}").expect("`users: {}` parses");
         assert!(seeded.users.is_empty());
 
         // The empty-file case is handled before deserialisation (an empty