push ci run metrics to victoriametrics, with a grafana board

A swarm-ci-metrics host unit on a 5-minute timer lists every forge
repo's Actions runs as the new read-only ci-metrics account and pushes
each finished run's duration and queue wait over OTLP, stamped at the
run's stop time. The first pass backfills from run 1. swarm-controller
mints the account's token into bao and keeps a ci-metrics team with
read on the Actions unit in every organisation.

Closes #5376

nix/host-modules/glue-ci-metrics-otel-oidc-client.nix

@@ -0,0 +1,36 @@
+# Glue: register the CI run poller as an OIDC client wherever authelia runs.
+#
+# ONE PAIRING PER FILE: that poller ← authelia, and nothing else.
+# Without it authelia mints no secret, the publisher has nothing to copy into
+# the store, and the poller's push is a 401.
+#
+# Gated on authelia being HERE, not on this host running the poller: a
+# client is a row in THIS host's provider config, the split
+# ./glue-ci-runner-otel-oidc-client.nix makes for the same reason.
+{
+  lib,
+  config,
+  ...
+}:
+let
+  hyperhiveCfg = config.services.hyperhive;
+  clientId = hyperhiveCfg.swarm.ci-metrics.clientId;
+in
+{
+  config = lib.mkIf hyperhiveCfg.deploy.authelia.enable {
+    services.hyperhive.swarm.authelia.oidc.clients = [
+      {
+        id = clientId;
+        description = "HyperHive CI run poller";
+        kind = "machine";
+        redirectUris = [ ];
+        # Its own id as its own permitted audience, the one the swarm
+        # collector's receiver for the poller checks.
+        audience = [ clientId ];
+        # The receiver verifies the token offline against `/jwks.json`;
+        # authelia's default opaque handle fails there.
+        accessTokenSignedResponseAlg = "RS256";
+      }
+    ];
+  };
+}