nix(authelia): start with a disabled placeholder user when the user set is empty

authelia 4.39.20 exits at startup on `users: {}` ("users: non zero value
required"), and the first-boot unit seeded exactly that, so a swarm with
no users crash-looped authelia and answered 502 until `swarmctl user add`
ran.

The first-boot unit now writes one subject, `swarm.placeholder`, when
the users database is absent, empty, or exactly `users: {}`:

- `disabled: true` — authelia returns "user not found" for a disabled
  user before any password check (file_user_provider.go,
  CheckUserPassword).
- password: an argon2id digest with an all-zero key. It decodes (authelia
  rejects a non-digest at startup) and no known password hashes to it.
- the `.` keeps it out of agent names (`[a-z0-9-]`), and `swarmctl user
  add` refuses it as already existing. Neither writer removes users, and
  both round-trip `disabled`.

A file with any user in it is never touched.

The docs that described the crash-loop (sso.md, gateway.md, setup.md,
the sso-unavailable error page) now describe the placeholder; the
writers' load_store docs and the seed fixtures follow. module-eval
nats-authelia asserts the seed branch.

swarmctl/src/users.rs

@@ -675,12 +675,12 @@ users:
     /// store claimed to be canonical. There is no overwrite to gate now: the
     /// file is read before it is written.
     ///
-    /// What still has to hold is that the first-boot seed and a zero-byte
-    /// file both mean "no users yet" rather than an error, so a fresh
-    /// deployment is not stranded.
+    /// What has to hold is that `users: {}` and a zero-byte file both mean
+    /// "no users" rather than an error, so a deployment holding either is
+    /// not stranded.
     #[test]
-    fn the_first_boot_seed_and_an_empty_file_both_mean_no_users() {
-        let seeded: UserStore = serde_norway::from_str("users: {}").expect("the seed parses");
+    fn an_empty_user_set_and_an_empty_file_both_mean_no_users() {
+        let seeded: UserStore = serde_norway::from_str("users: {}").expect("`users: {}` parses");
         assert!(seeded.users.is_empty());
 
         // The empty-file case is handled before deserialisation (an empty