bao: OIDC login to the browser UI via authelia, as a metadata-only viewer

The bao UI at bao-ui.<swarm> took a raw store token and nothing else.
It now offers an OIDC tab: authelia's `admins` group logs in and lands
on `swarm-operator-viewer`, which is list+read on `secret/metadata/*`
and nothing under `secret/data/` or `sys/`.

- authelia registers an interactive client `swarm-bao-ui`
  (glue-bao-ui-oidc-client.nix) with redirect
  `https://bao-ui.<swarm>/ui/vault/auth/oidc/oidc/callback`; the secret
  publisher carries its secret to
  `secret/swarm/services/swarm-bao-ui/oidc/client`.
- `swarm-bao-granter-role` (bootstrap token) enables the `oidc` auth
  mount with listing visibility `unauth`, asked before attempted like
  cert/approle; `bao-bootstrap-policy.hcl` gains `sys/auth/oidc`.
- The granter's policy gains `auth/oidc/config`, `auth/oidc/role/swarm-*`
  and read on that one secret leaf. It still holds no `sys/auth`.
- New granting unit `swarm-bao-operator-viewer-policy` writes the viewer
  policy, and once the granter may configure `auth/oidc/config` (checked
  through `sys/capabilities-self`), writes the mount's config from the
  published secret and the role binding `groups=admins` to the viewer.
  Before the bootstrap step re-runs it writes the policy, logs the step
  and exits 0.

Route (a) per mara on #4775: enabling the auth method stays a
bootstrap-token step, re-run once on the live store.

module-eval pins the viewer policy's single metadata stanza, that the
granter's policy has no sys/auth path, the oidc enable in the bootstrap
unit, the exit-0 path, the config/role contents, and the client
registration + publish.

docs/swarm/secrets.md

@@ -432,8 +432,9 @@ whichever certificate the reader presents, unchanged.
 
 OpenBao's built-in web UI is at `https://bao-ui.<swarm domain>/`
 (`swarm.bao.ui.domain`), for members of authelia's `admins` group only. Log in
-with a bao token. The gateway vhost checks the session with authelia and
-proxies to an nginx inside the store's container on
+with the **OIDC** tab, or with a bao token under **Other**. The gateway vhost
+checks the session with authelia and proxies to an nginx inside the store's
+container on
 `127.0.0.1:<deploy.bao.uiProxyPort>`. That nginx forwards `/ui/` and `/v1/` to
 a second openbao listener on `127.0.0.1:<deploy.bao.uiPort>`, answers 403 on
 the unseal, seal, step-down, rekey and generate-root endpoints, and 404 on
@@ -447,6 +448,29 @@ doesn't wait for the store: it serves the hive certificate on the UI's name (a
 browser warning) until the unsealed store issues the services leaf, so the
 stream passthrough readers use on that host comes up with the store sealed.
 
+### OIDC login
+
+The OIDC tab logs in through authelia as the client `swarm-bao-ui`
+(`swarm.bao.ui.oidc.clientId`). An `admins` member gets a token under
+`swarm-operator-viewer`: `list` and `read` on `secret/metadata/*`. That shows
+the key tree and each key's versions and timestamps, and no value: the store
+refuses every `secret/data/` read. Anything more needs a token.
+
+| piece                                                                               | written by                                                                                       |
+| ----------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ |
+| authelia client, with redirect `swarm.bao.ui.oidc.redirectUri`                      | `glue-bao-ui-oidc-client.nix`, wherever authelia runs                                            |
+| its secret at `swarm/services/swarm-bao-ui/oidc/client`                             | `swarm-secret-publish`, like every other service's                                               |
+| the `oidc` auth mount                                                               | `swarm-bao-granter-role`, with the bootstrap token                                               |
+| `swarm-operator-viewer` policy, the mount's config and role `swarm-operator-viewer` | `swarm-bao-operator-viewer-policy`, as the granter, which reads the secret above into the config |
+
+The granter holds no `sys/auth`, so enabling the mount stays a bootstrap-token
+step. A store set up before the mount existed needs the
+[one-time granter step](../getting-started/setup.md) again: it re-writes
+`bao-bootstrap`, which covers `sys/auth/oidc`, and the granter's own
+policy, which covers `auth/oidc/`. Until then
+`swarm-bao-operator-viewer-policy` writes the viewer policy, logs the step, and
+exits 0, and the UI offers token login only.
+
 ## The constraint that decides where the root lives
 
 A hive CA carries `nameConstraints=permitted;DNS:<hive domain>`, and **a swarm