forward the attic container's journal to the swarm collector

nix/host-modules/swarm-attic-options.nix

@@ -13,6 +13,21 @@ let
 in
 {
   options.services.hyperhive.swarm.attic = {
+    otel.clientId = lib.mkOption {
+      type = lib.types.str;
+      readOnly = true;
+      default = "swarm-attic-collector";
+      description = ''
+        OAuth2 client id the journal forwarder inside the cache's container
+        authenticates as, and the audience it asks its token for.
+
+        Read-only because three hosts have to agree on it: authelia registers
+        the client (`glue-attic-otel-oidc-client.nix`), the swarm collector
+        admits it on the container's receiver (`swarm.otel.serviceProducers`),
+        and the secret publisher carries its secret to the store.
+      '';
+    };
+
     ownDomain = lib.mkOption {
       type = lib.types.str;
       readOnly = true;