push ci run metrics to victoriametrics, with a grafana board

A swarm-ci-metrics host unit on a 5-minute timer lists every forge
repo's Actions runs as the new read-only ci-metrics account and pushes
each finished run's duration and queue wait over OTLP, stamped at the
run's stop time. The first pass backfills from run 1. swarm-controller
mints the account's token into bao and keeps a ci-metrics team with
read on the Actions unit in every organisation.

Closes #5376

nix/host-modules/swarm-otel-service.nix

@@ -445,6 +445,12 @@ in
       clientId = hyperhiveCfg.swarm.victoriametrics.otel.clientId;
       port = lib.mkDefault 4401;
     };
+    # The CI run poller in ./swarm-ci-metrics.nix, a host unit that pushes
+    # its run samples here directly.
+    swarm-ci-metrics = {
+      clientId = hyperhiveCfg.swarm.ci-metrics.clientId;
+      port = lib.mkDefault 4403;
+    };
   };
 
   # Not under any `enable`: see `publishedScrapeTargets` for why every host