deploy: move authelia's three host paths out of swarm.authelia

`usersFile`, `hostClientSecretDir` and `hostUsersFile` are filesystem
paths that only exist on the machine running the `swarm-authelia`
container. A hive that does not run it has nothing at any of them, so
they fail the swarm-wide test the namespace's header states.

`usersFile` is a path *inside* the container and still belongs on the
deploy side: a path's scope is the scope of the filesystem it names, and
that filesystem is this host's container root.

The two `host*` options are `readOnly` and derived, so nothing can set
them through the rename shims — those serve readers. The shims are still
required: `mkRenamedOptionModule` is what keeps an out-of-tree module
reading the old path resolving at all.

Seven reads went through an alias rather than a full path
(`autheliaCfg.hostClientSecretDir` in five modules, `.hostUsersFile` in a
sixth, `swarmCfg.authelia.hostClientSecretDir` in a seventh). Every one
of those files already binds `deployCfg`, so the repoint needed no new
alias. Four more sites were prose, including one in `docs/`, which no
grep restricted to `nix/` would have found.

docs/swarm/README.md

@@ -338,7 +338,7 @@ On a host that runs the queue and the IdP itself, all three default to
 the local ones and there is nothing to set. Any other hive needs them
 spelled out, and needs the secret to physically be there: the swarm does
 not distribute it. Copy `hive-<hiveName>.secret` out of the swarm host's
-`swarm.authelia.hostClientSecretDir` with whatever secret management the
+`deploy.authelia.hostClientSecretDir` with whatever secret management the
 deployment already uses.
 
 The identity is not a choice — a hive authenticates as `hive-<hiveName>`