swarm options: no swarm.* value depends on a deploy option or this host's hive

- swarm.serviceDomains lists every swarm service name on every host. The
  store's issuing role is built from it, so the store now admits a leaf
  for grafana, metrics, otel, logs, the bao UI and the apex whichever host
  runs the store. Each gateway's own leaf stays narrowed by
  localServiceDomains.
- swarm.matrix.apiUrl defaults to http://<swarm.matrix.gatewayHost>
  (null when gatewayHost is null) instead of loopback on the matrix host.
- The authelia vhost proxies /bridge/ to swarm-authelia-bridge with the
  prefix stripped, and deploy.swarm-controller.authBridgeUrl defaults to
  ${swarm.authelia.url}/bridge on every host. swarm.authelia.bridgeUrl is
  removed.
- swarm-authelia-bridge admits only swarm-controller's OIDC client on
  every request (403 for any other active token), configured by
  SWARM_AUTHELIA_BRIDGE_CONTROLLER_CLIENT_ID (renamed from
  ..._OPERATOR_READER_CLIENT_ID, which gated ListOperators alone).
- swarm.peerHives is removed; swarm-wireguard.nix filters this host's own
  hive out of swarm.hives itself.

Closes #4933

docs/swarm/services.md

@@ -106,6 +106,14 @@ there is one IdP and one auth path.
 Agent subjects come from swarm-controller's agent-creation job, written
 into the users database by `swarm-authelia-bridge`; human ones come from
 `swarmctl user add` → [setup.md § 2](../getting-started/setup.md#2--your-sso-account).
+
+The bridge listens on loopback on the authelia host, and the gateway
+publishes it as
+`https://<swarm.authelia.domain>/bridge/`, which is where
+`deploy.swarm-controller.authBridgeUrl` points by default on every host.
+It answers only swarm-controller's OIDC client
+(`swarm.controller.queueClientId`) and refuses every other token `403`.
+
 On first boot this module seeds the users database with a disabled placeholder subject, so authelia has a non-empty store to start against before any real account exists (`swarm-authelia.nix:873`). Authelia generates session and storage keys in the container on
 first boot and never rotates them automatically; replacing one
 invalidates data already written (sessions, the encrypted store), so