swarm-controller: make authelia's operators matrix homeserver admins

swarm-authelia-bridge gains ListOperators, the usernames in authelia's
operator group (`operatorGroup = "admins"`, passed in from
swarm-authelia.nix). Unlike the two agent verbs, which admit any active
token, it answers only the client named by
SWARM_AUTHELIA_BRIDGE_OPERATOR_READER_CLIENT_ID (swarm-controller's
queueClientId) and returns 403 to every other active token: authelia
issues machine tokens to every hive and its agents as well. The bridge's
introspection now models `client_id` to make that check, the same way
swarm-nats-auth's does.

swarm-controller runs a grant-only pass at start and every five minutes:
read the group, map each username to the account an SSO login lands on
(tuwunel lowercases `preferred_username`), skip anyone already joined to
`#admins:<server>` (tuwunel's definition of admin) or without a matrix
account, and send `!admin users make-user-admin <user>` there as @swarm
with the swarm appservice token. Nothing is ever revoked: tuwunel has no
command for it (#4799).

The admin-room calls (alias, joined members, profile, send) go into
swarm-matrix-client next to whoami, keeping its no-body-in-errors rule.

Closes #4585

docs/swarm/sso.md

@@ -181,7 +181,7 @@ result isn't.
 | callback URL              | `<root>/user/oauth2/<source>/callback`                                             | `<homeserver>/_matrix/client/unstable/login/sso/callback/<client_id>`, a shape tuwunel fixes rather than accepts |
 | cost of a malformed entry | the login source is missing                                                        | the homeserver can refuse to start                                                                               |
 
-Three consequences worth stating plainly:
+Four consequences worth stating plainly:
 
 - **A person's first forge login creates their forge account**, named
   after authelia's `preferred_username` (`[oauth2_client]` in the forge
@@ -192,6 +192,11 @@ Three consequences worth stating plainly:
   `swarm-controller` all have local accounts, and `swarmctl user add`
   refuses none of those names.
 
+- **A member of `admins` becomes a matrix homeserver admin** once their
+  first matrix login has created the account: `swarm-controller` promotes
+  them within five minutes, and never demotes. See
+  [`../integrations/matrix.md`](../integrations/matrix.md#operators-are-homeserver-admins).
+
 - **tuwunel re-reads its secret file on every OAuth exchange**, not only
   at startup, and its own sandboxing hides most paths from it. It gets the
   file through `LoadCredential` for the same reason the appservice