store the forge webhook secret and grafana's secret key in bao, seeded from the existing files

nix/host-modules/swarm-bao.nix

@@ -514,6 +514,10 @@ let
       capabilities = ["read"]
     }
 
+    path "${credentialMountPath}/data/${controllerWebhookSecretLeaf}" {
+      capabilities = ["create", "read"]
+    }
+
     path "${agentPkiMountPath}/issue/${agentPkiRoleName}" {
       capabilities = ["update"]
     }
@@ -581,6 +585,10 @@ let
       capabilities = ["deny"]
     }
 
+    path "${credentialMountPath}/data/${grafanaSecretKeyLeaf}" {
+      capabilities = ["deny"]
+    }
+
     path "${credentialMountPath}/data/${classifierForgeTokenLeaf}" {
       capabilities = ["deny"]
     }
@@ -656,6 +664,12 @@ let
   # writes it; the controller reads it and holds no other copy.
   controllerGrafanaTokenLeaf = "swarm/controller/swarm-controller/grafana/token";
 
+  # The HMAC secret of the swarm-wide forge webhooks, the nix half of
+  # `swarm_secret_client::forge::controller_webhook_secret_path`. The controller
+  # creates it, seeded from its old state-directory file, and reads it; `create`
+  # without `update`, so the first value stored is the one every start reads.
+  controllerWebhookSecretLeaf = "swarm/controller/swarm-controller/forge/webhook-secret";
+
   # The forge's runner registration token, the nix half of
   # `swarm_secret_client::ci::registration_token_path`. The controller writes
   # it and cannot read it back (`forge::runner_token` keeps the value it last
@@ -963,7 +977,8 @@ let
   #
   # Grafana's leaf also creates its admin password (`swarm-bao-grafana-admin`
   # in ./swarm-grafana.nix) and the bearer its metrics datasource presents
-  # (`swarm-bao-grafana-metrics-bearer`). `create` without `update`, so a stored
+  # (`swarm-bao-grafana-metrics-bearer`) and its datasource-encryption key
+  # (`swarm-bao-grafana-secret-key`). `create` without `update`, so a stored
   # value is never replaced.
   #
   # The controller's Grafana token is the one it may replace:
@@ -979,6 +994,7 @@ let
         + readStanza "${credentialMountPath}/data/swarm/services/${hyperhiveCfg.swarm.grafana.otel.clientId}/oidc/client"
         + createStanza "${credentialMountPath}/data/${grafanaAdminLeaf}"
         + createStanza "${credentialMountPath}/data/${grafanaMetricsBearerLeaf}"
+        + createStanza "${credentialMountPath}/data/${grafanaSecretKeyLeaf}"
         + ''
           path "${credentialMountPath}/data/${controllerGrafanaTokenLeaf}" {
             capabilities = ["create", "read", "update"]
@@ -1056,6 +1072,10 @@ let
   # ./swarm-victoriametrics.nix and ./swarm-victorialogs.nix.
   grafanaMetricsBearerLeaf = "swarm/services/${hyperhiveCfg.swarm.grafana.oidc.clientId}/metrics/bearer";
 
+  # Grafana's datasource-encryption key, which only Grafana's leaf creates. The
+  # nix half of `secretKeyStorePath` in ./swarm-grafana.nix.
+  grafanaSecretKeyLeaf = "swarm/services/${hyperhiveCfg.swarm.grafana.oidc.clientId}/secret-key";
+
   createStanza = path: ''
     path "${path}" {
       capabilities = ["create", "read"]