swarm-bao granter stops retrying a rejected bootstrap token

swarm-bao-granter-role exits 4 when the store is unsealed but refuses the
bootstrap token, and Restart=on-failure retried that every 30s for as long
as the token file existed. RestartPreventExitStatus=4 makes that permanent
failure leave the unit failed once. Exit 1 (store sealed or unreachable)
keeps retrying.

On deploy: the unit goes red once instead of looping every 30s. The stale
token on muede-lpt2 still needs the operator step (remove it or mint a
fresh one); this does not clear it.

nix/host-modules/swarm-bao.nix

@@ -3135,6 +3135,9 @@ in
           RemainAfterExit = true;
           Restart = "on-failure";
           RestartSec = 30;
+          # Exit 4 is a refused bootstrap token, which retrying cannot fix:
+          # the unit stays failed until the operator replaces the token.
+          RestartPreventExitStatus = "4";
           TimeoutStartSec = 60;
           # Runs only once the script above exits 0, which is when the
           # granter may first configure `auth/oidc`; the viewer unit exits 0