keep authelia's keys in bao, seeded from the existing key files

nix/host-modules/swarm-bao.nix

@@ -543,9 +543,9 @@ let
   # here too — a grant widens when a path gains a WRITER, not when a kind is
   # declared.
   #
-  # Write-only but for one leaf, the client secret of its container's forwarder:
-  # a read on a prefix would let a file-copier recover every hive's credentials.
-  # That stanza repeats `create`/`update`, which its exact path would drop.
+  # Write-only but for its forwarder's client secret and authelia's keys, read at
+  # exact leaves: a read on a prefix would let a file-copier recover every
+  # hive's credentials. The forwarder's stanza repeats `create`/`update`.
   #
   # The queue callout's three seeds sit under `swarm/services/` and are no
   # secret this principal copies, so their exact paths, which outrank the
@@ -608,7 +608,8 @@ let
     path "${credentialMountPath}/data/swarm/services/${hyperhiveCfg.swarm.authelia.otel.clientId}/oidc/client" {
       capabilities = ["create", "update", "read"]
     }
-  '';
+  ''
+  + lib.concatMapStrings (leaf: createStanza "${credentialMountPath}/data/${leaf}") autheliaKeyLeaves;
 
   # The identity the matrix container's `swarm-matrix-ctl` presents. Named outside `hive-*`
   # for the reason its two siblings above give — the controller may rewrite
@@ -1087,6 +1088,19 @@ let
   # nix half of `secretKeyStorePath` in ./swarm-grafana.nix.
   grafanaSecretKeyLeaf = "swarm/services/${hyperhiveCfg.swarm.grafana.oidc.clientId}/secret-key";
 
+  # authelia's jwt, session, storage-encryption, OIDC HMAC and OIDC issuer keys,
+  # which only the secret publisher in authelia's container creates and reads.
+  # The nix half of `keyLeaf` in ./swarm-authelia.nix. `create` without
+  # `update`, so a stored key is never replaced: the storage-encryption key
+  # encrypts authelia's database and the issuer key signs every id token.
+  autheliaKeyLeaves = map (name: "swarm/services/${autheliaCfg.machine}/keys/${name}") [
+    "jwt"
+    "session"
+    "storage-encryption"
+    "oidc-hmac"
+    "oidc-issuer"
+  ];
+
   createStanza = path: ''
     path "${path}" {
       capabilities = ["create", "read"]