swarm-controller: make authelia's operators matrix homeserver admins

swarm-authelia-bridge gains ListOperators, the usernames in authelia's
operator group (`operatorGroup = "admins"`, passed in from
swarm-authelia.nix). Unlike the two agent verbs, which admit any active
token, it answers only the client named by
SWARM_AUTHELIA_BRIDGE_OPERATOR_READER_CLIENT_ID (swarm-controller's
queueClientId) and returns 403 to every other active token: authelia
issues machine tokens to every hive and its agents as well. The bridge's
introspection now models `client_id` to make that check, the same way
swarm-nats-auth's does.

swarm-controller runs a grant-only pass at start and every five minutes:
read the group, map each username to the account an SSO login lands on
(tuwunel lowercases `preferred_username`), skip anyone already joined to
`#admins:<server>` (tuwunel's definition of admin) or without a matrix
account, and send `!admin users make-user-admin <user>` there as @swarm
with the swarm appservice token. Nothing is ever revoked: tuwunel has no
command for it (#4799).

The admin-room calls (alias, joined members, profile, send) go into
swarm-matrix-client next to whoami, keeping its no-body-in-errors rule.

Closes #4585

docs/integrations/matrix.md

@@ -169,6 +169,25 @@ when it's missing, unknown to the homeserver, or someone else's. An
 agent's daemon picks a re-minted token up on its next start, and a timer
 restarts it while it's down.
 
+### Operators are homeserver admins
+
+Every member of authelia's `admins` group who has a matrix account is a
+homeserver admin. `swarm-controller` reads the group through
+`swarm-authelia-bridge` at start and every five minutes after, and for
+each member not yet in `#admins:<server_name>` it sends
+`!admin users make-user-admin @<name>:<server_name>` there as `@swarm`.
+`<name>` is the authelia username lowercased, the account an SSO login
+lands on.
+
+- **Grant-only.** Removing someone from `admins` leaves their matrix
+  admin in place: tuwunel has no command that takes it away.
+- **No account, no grant.** A member who has never logged in to matrix
+  has no account to promote. The first pass after their first SSO login
+  promotes them.
+- Runs only on a controller with both
+  `services.hyperhive.deploy.swarm-controller.authBridgeUrl` and
+  `services.hyperhive.deploy.swarm-controller.matrixHomeserverUrl` set.
+
 ### The appservice's sender account, and why it isn't an admin
 
 `@hive-<hive>:<server_name>` is the appservice's own `sender_localpart`,