swarm-controller: serve swarm-wide service quick links (hyperhive#3289)

New `services.hyperhive.swarm.controller.links` option (listOf {label,
icon, url}, same shape as the per-agent hyperhive.dashboardLinks) plus
a new GET /api/links route serving it, same pattern as the existing
hives/GET /api/hives.

Rather than one central hardcoded list, each service's own module
contributes its own entry when actually enabled on the controller's
host: swarm-authelia.nix, hive-matrix.nix (gated on gui.enable too,
since / on that vhost only serves fluffychat then) and
hive-forge/default.nix (gated on behindGateway) each push one entry,
the same list-merge idiom services.hyperhive.gateway.localNames
already uses. swarm-ui.nix contributes a static entry for its own
same-origin swagger docs. Adding a future service's link is a nix-only
change to that service's own module.

Verified: cargo build/clippy/test -p swarm-controller clean, a
throwaway nixosSystem eval confirms all 4 entries merge correctly into
SWARM_CONTROLLER_LINKS, nix build .#swarm-controller succeeds.

nix/host-modules/swarm-authelia.nix

@@ -485,6 +485,18 @@ in
     # bridge at that wrong answer.
     services.hyperhive.gateway.localNames = [ cfg.domain ];
 
+    # This swarm-ui quick-links entry, same guard as the vhost/DNS name
+    # above (only the host actually running the container claims it —
+    # see `services.hyperhive.swarm.controller.links`'s description for
+    # the contribute-your-own-entry idiom).
+    services.hyperhive.swarm.controller.links = [
+      {
+        label = "Authelia";
+        icon = "🔑";
+        url = "https://${cfg.domain}/";
+      }
+    ];
+
     # `server_name = authelia.domain`, all of `/` → authelia.
     #
     # ⚠️ The server name must be exactly `cfg.domain`, not a near-miss: