bao: OIDC login to the browser UI via authelia, as a metadata-only viewer

The bao UI at bao-ui.<swarm> took a raw store token and nothing else.
It now offers an OIDC tab: authelia's `admins` group logs in and lands
on `swarm-operator-viewer`, which is list+read on `secret/metadata/*`
and nothing under `secret/data/` or `sys/`.

- authelia registers an interactive client `swarm-bao-ui`
  (glue-bao-ui-oidc-client.nix) with redirect
  `https://bao-ui.<swarm>/ui/vault/auth/oidc/oidc/callback`; the secret
  publisher carries its secret to
  `secret/swarm/services/swarm-bao-ui/oidc/client`.
- `swarm-bao-granter-role` (bootstrap token) enables the `oidc` auth
  mount with listing visibility `unauth`, asked before attempted like
  cert/approle; `bao-bootstrap-policy.hcl` gains `sys/auth/oidc`.
- The granter's policy gains `auth/oidc/config`, `auth/oidc/role/swarm-*`
  and read on that one secret leaf. It still holds no `sys/auth`.
- New granting unit `swarm-bao-operator-viewer-policy` writes the viewer
  policy, and once the granter may configure `auth/oidc/config` (checked
  through `sys/capabilities-self`), writes the mount's config from the
  published secret and the role binding `groups=admins` to the viewer.
  Before the bootstrap step re-runs it writes the policy, logs the step
  and exits 0.

Route (a) per mara on #4775: enabling the auth method stays a
bootstrap-token step, re-run once on the live store.

module-eval pins the viewer policy's single metadata stanza, that the
granter's policy has no sys/auth path, the oidc enable in the bootstrap
unit, the exit-0 path, the config/role contents, and the client
registration + publish.

nix/module-eval/secret-publisher.nix

@@ -157,6 +157,28 @@ let
         secretPublisherHere.systemd.services.swarm-secret-publish.script
       );
     }
+    {
+      # The store's UI login: authelia registers the client with the callback
+      # the store's `oidc` role allows, and the publisher carries its secret
+      # to the path `swarm-bao-operator-viewer-policy` reads. Not registered
+      # where authelia is not.
+      name = "the store UI's client is registered interactive at its callback, and the publisher carries its secret";
+      ok =
+        let
+          ui = lib.findFirst (
+            c: c.id == "swarm-bao-ui"
+          ) null secretPublisherHere.services.hyperhive.swarm.authelia.oidc.clients;
+        in
+        ui != null
+        && ui.kind == "interactive"
+        && ui.redirectUris == [ "https://bao-ui.t.local/ui/vault/auth/oidc/oidc/callback" ]
+        && lib.hasInfix "secret/swarm/services/swarm-bao-ui/oidc/client" (
+          secretPublisherHere.systemd.services.swarm-secret-publish.script
+        )
+        && !(lib.any (
+          c: c.id == "swarm-bao-ui"
+        ) grafanaRemoteAuthelia.services.hyperhive.swarm.authelia.oidc.clients);
+    }
     {
       # The same hole the controller's case above names, open a second time: the
       # PKI script grew a third leaf and no case read it.