credential units: 24h retry shape; start a failed nginx when the cert lands

Six credential-fetch units retried 4 times at 15s, so an apply during
which the store or gateway was down for more than about a minute left
them in start-limit-hit, and nothing started them again once the store
came back. The swarm-services leaf could also land after nginx had
already given up on it, and the hook that propagates a new leaf only
reloaded a running nginx, so a stopped one stayed down until a second
apply.

- nix/host-modules/lib/store-retry.nix: the 2880 x 30s / 25h window
  shape swarm-services-cert already had, as one attrset.
- swarm-services-cert, swarm-bao-otel-oidc, swarm-bao-forwarder-oidc,
  swarm-bao-matrix-token, swarm-bao-queue-agent, swarm-bao-grafana-oidc,
  hive-agent-bao-identity and hive-agent-forge-token use it.
  queue-identity.nix no longer has a fetch unit (ccb5bd3b), and
  forge-token.nix is a fetch unit with the same short budget that was
  added after the census in #4662.
- The swarm-services-cert propagation hook now reset-fails and starts
  (--no-block) a loaded nginx that is not active; an active nginx keeps
  the re-import + reload.
- module-eval-bao-grants: one case pinning the shape on every host-side
  fetch unit, swarm-services-cert included.

Refs #4662

nix/host-modules/swarm-bao.nix

@@ -1188,6 +1188,7 @@ let
   # sharing the netns is what lets the store bind the host's own addresses
   # rather than a convenience for nginx.
   privateNetwork = false;
+  storeRetry = import ./lib/store-retry.nix { };
 in
 {
   imports = [
@@ -2379,20 +2380,15 @@ in
           baoDeploy.package
           pkgs.coreutils
         ];
-        # Sized for the race this loses: the secret is minted by authelia and
-        # copied in by the publisher, both of which may be a host away and
-        # neither of which this boot waits on. `StartLimit*` are `[Unit]`
-        # settings — systemd ignores them under `[Service]` — and the window
-        # has to exceed `RestartSec × burst`.
-        startLimitBurst = 4;
-        startLimitIntervalSec = 300;
-        serviceConfig = {
+        # ./lib/store-retry.nix: the secret is minted by authelia and copied in
+        # by the publisher, both of which may be a host away and neither of
+        # which this boot waits on.
+        inherit (storeRetry) startLimitBurst startLimitIntervalSec;
+        serviceConfig = storeRetry.serviceConfig // {
           Type = "oneshot";
           RemainAfterExit = true;
           SyslogIdentifier = "swarm-bao-forwarder-oidc";
           TimeoutStartSec = 30;
-          Restart = "on-failure";
-          RestartSec = 15;
         };
         environment = {
           BAO_ADDR = "https://${cfg.domain}:${toString cfg.port}";