bao reader policy, responder units and docs for the per-surface grant

nix/host-modules/swarm-victoriametrics.nix

@@ -295,8 +295,9 @@ in
       remembered.
 
       This is also how long a re-minted or deleted queue secret keeps working
-      at the metrics store's read API after its last successful check. `0`
-      checks the store on every query.
+      at the metrics store's read API after its last successful check. It is
+      equally how long a revoked `metrics` permission keeps working. `0` checks
+      the store on every query.
     '';
   };
 
@@ -610,6 +611,7 @@ in
           "${deployCfg.victoriametrics.agentAuthPackage}/bin/swarm-logs-auth"
           "--socket ${agentAuthSocket}"
           "--store-cert-role swarm-metrics-auth"
+          "--surface metrics"
           "--verdict-ttl ${toString deployCfg.victoriametrics.agentAuthVerdictTtl}"
         ];
         LoadCredential = lib.mapAttrsToList (id: path: "${id}:${path}") metricsAuthStoreFiles;