push ci run metrics to victoriametrics, with a grafana board

A swarm-ci-metrics host unit on a 5-minute timer lists every forge
repo's Actions runs as the new read-only ci-metrics account and pushes
each finished run's duration and queue wait over OTLP, stamped at the
run's stop time. The first pass backfills from run 1. swarm-controller
mints the account's token into bao and keeps a ci-metrics team with
read on the Actions unit in every organisation.

Closes #5376

nix/host-modules/swarm-required-services.nix

@@ -127,6 +127,13 @@ in
     && deployCfg.bao.builderClientKeyFile != null
   );
 
+  # The CI run poller, by the same rule: its module asserts its store identity.
+  config.services.hyperhive.deploy.ci-metrics.enable = lib.mkDefault (
+    deployCfg.allSwarmServices
+    && deployCfg.bao.ciMetricsClientCertFile != null
+    && deployCfg.bao.ciMetricsClientKeyFile != null
+  );
+
   # The claude login minter, defaulted on the same terms as the review
   # classifier.
   config.services.hyperhive.deploy.claude-login.enable = lib.mkDefault (