push ci run metrics to victoriametrics, with a grafana board

A swarm-ci-metrics host unit on a 5-minute timer lists every forge
repo's Actions runs as the new read-only ci-metrics account and pushes
each finished run's duration and queue wait over OTLP, stamped at the
run's stop time. The first pass backfills from run 1. swarm-controller
mints the account's token into bao and keeps a ci-metrics team with
read on the Actions unit in every organisation.

Closes #5376

nix/host-modules/default.nix

@@ -47,6 +47,7 @@
     ./glue-nats-wireguard.nix
     ./glue-queue-agent-credential.nix
     ./glue-builder-oidc-client.nix
+    ./glue-ci-metrics-otel-oidc-client.nix
     ./glue-ci-runner-otel-oidc-client.nix
     ./glue-claude-login-oidc-client.nix
     ./glue-forge-otel-oidc-client.nix
@@ -65,6 +66,7 @@
     ./swarm-bao.nix
     ./swarm-builder.nix
     ./swarm-claude-login.nix
+    ./swarm-ci-metrics.nix
     ./swarm-ci-runner.nix
     ./swarm-review-classifier.nix
     ./swarm-secret-publisher.nix