fix(3112): nkey only, no username on the callout-exempt user

Measured against a running server built from this module's own rendered
config, not a hand-written one -- which is the fix to the method as much
as to the file. Two shapes died in a row: a bare name authenticates
anyone who sends it, and a name plus an nkey refuses to start at all
(nkey users do not take usernames or passwords).

A malformed key is fail-closed too, so the only way to a live server
here is a real key whose seed nobody but the responder holds.

nix/host-modules/swarm-nats.nix

@@ -16,7 +16,6 @@ let
   # authorizes.
   calloutAccount = "AUTH";
   clientAccount = "APP";
-  calloutUser = "auth";
 in
 {
   # The swarm's message queue: one NATS server, reached by every hive.
@@ -227,12 +226,22 @@ in
                 # container on the shared netns — the same class of hole
                 # this module exists to close, moved rather than fixed.
                 # Caught in review on the first version of this file.
-                ${calloutAccount}.users = [
+                # An nkey and NOTHING else, both halves measured against a
-                  {
+                # running server rather than reasoned about:
-                    user = calloutUser;
+                #
-                    nkey = cfg.calloutUserPublicKey;
+                #   { user = "auth"; }               → `CONNECT {"user":"auth"}`
-                  }
+                #                                      is accepted with no
-                ];
+                #                                      credential at all
+                #   { user = "auth"; nkey = "U…"; }  → refuses to START:
+                #                                      "Nkey users do not take
+                #                                      usernames or passwords"
+                #   { nkey = "U…"; }                 → what this is
+                #
+                # A malformed key is fail-closed too: the server exits with
+                # "Not a valid public nkey for a user" rather than starting
+                # with a hole. So the only way to get a live server here is
+                # a real key whose seed nobody but the responder holds.
+                ${calloutAccount}.users = [ { nkey = cfg.calloutUserPublicKey; } ];
                 ${clientAccount} = { };
               };
 
@@ -260,7 +269,7 @@ in
                 # to say yes.
                 auth_callout = {
                   issuer = cfg.calloutIssuerPublicKey;
-                  auth_users = [ calloutUser ];
+                  auth_users = [ cfg.calloutUserPublicKey ];
                   account = calloutAccount;
                 };
               };