swarm-controller: make authelia's operators matrix homeserver admins

swarm-authelia-bridge gains ListOperators, the usernames in authelia's
operator group (`operatorGroup = "admins"`, passed in from
swarm-authelia.nix). Unlike the two agent verbs, which admit any active
token, it answers only the client named by
SWARM_AUTHELIA_BRIDGE_OPERATOR_READER_CLIENT_ID (swarm-controller's
queueClientId) and returns 403 to every other active token: authelia
issues machine tokens to every hive and its agents as well. The bridge's
introspection now models `client_id` to make that check, the same way
swarm-nats-auth's does.

swarm-controller runs a grant-only pass at start and every five minutes:
read the group, map each username to the account an SSO login lands on
(tuwunel lowercases `preferred_username`), skip anyone already joined to
`#admins:<server>` (tuwunel's definition of admin) or without a matrix
account, and send `!admin users make-user-admin <user>` there as @swarm
with the swarm appservice token. Nothing is ever revoked: tuwunel has no
command for it (#4799).

The admin-room calls (alias, joined members, profile, send) go into
swarm-matrix-client next to whoami, keeping its no-body-in-errors rule.

Closes #4585

swarm-controller/src/auth.rs

@@ -97,6 +97,21 @@ impl AuthBridge {
         }
     }
 
+    /// The usernames in authelia's operator group. The bridge answers this
+    /// to this daemon's client only.
+    ///
+    /// Names only, for [`Self::list_agent_identities`]'s reason.
+    pub async fn list_operators(&self) -> Result<Vec<String>> {
+        match self.request(&BridgeRequest::ListOperators).await? {
+            BridgeResponse::Operators { operators } => Ok(operators),
+            other => {
+                anyhow::bail!(
+                    "swarm-authelia-bridge answered an operator-list request with {other:?}"
+                )
+            }
+        }
+    }
+
     /// One authenticated round-trip to the bridge.
     ///
     /// A fresh token per call, deliberately — see the module doc. Shared by