bao reader policy, responder units and docs for the per-surface grant

nix/host-modules/swarm-victorialogs.nix

@@ -216,8 +216,9 @@ in
       without reading the secret store. A denial is never remembered.
 
       This is also how long a re-minted or deleted queue secret keeps working
-      at the log store's query route after its last successful check. `0`
-      checks the store on every query.
+      at the log store's query route after its last successful check. It is
+      equally how long a revoked `logs` permission keeps working. `0` checks
+      the store on every query.
     '';
   };
 
@@ -514,6 +515,7 @@ in
           "--socket ${logsAuthSocket}"
           # The role ./swarm-bao.nix writes on the store's `cert` mount.
           "--store-cert-role swarm-logs-auth"
+          "--surface logs"
           "--verdict-ttl ${toString deployCfg.victorialogs.authVerdictTtl}"
         ];
         # Paths only: `argv` is world-readable via /proc/<pid>/cmdline.