swarm options: no swarm.* value depends on a deploy option or this host's hive

- swarm.serviceDomains lists every swarm service name on every host. The
  store's issuing role is built from it, so the store now admits a leaf
  for grafana, metrics, otel, logs, the bao UI and the apex whichever host
  runs the store. Each gateway's own leaf stays narrowed by
  localServiceDomains.
- swarm.matrix.apiUrl defaults to http://<swarm.matrix.gatewayHost>
  (null when gatewayHost is null) instead of loopback on the matrix host.
- The authelia vhost proxies /bridge/ to swarm-authelia-bridge with the
  prefix stripped, and deploy.swarm-controller.authBridgeUrl defaults to
  ${swarm.authelia.url}/bridge on every host. swarm.authelia.bridgeUrl is
  removed.
- swarm-authelia-bridge admits only swarm-controller's OIDC client on
  every request (403 for any other active token), configured by
  SWARM_AUTHELIA_BRIDGE_CONTROLLER_CLIENT_ID (renamed from
  ..._OPERATOR_READER_CLIENT_ID, which gated ListOperators alone).
- swarm.peerHives is removed; swarm-wireguard.nix filters this host's own
  hive out of swarm.hives itself.

Closes #4933

hive-c0re/src/server.rs

@@ -451,17 +451,16 @@ async fn handle_set_resource_limits(
 
 /// Guard: matrix provisioning needs a homeserver to provision against.
 ///
-/// Answers "is one configured", not "is one running here" — the message names
-/// both ways to get there, since a hive that talks to someone else's
-/// homeserver never enables the local container at all.
+/// Answers "is one configured", not "is one running here": the address is
+/// the swarm's homeserver, wherever it runs.
 fn require_matrix_present() -> Result<()> {
     if crate::matrix::is_present() {
         return Ok(());
     }
     anyhow::bail!(
-        "no matrix homeserver configured — set services.hyperhive.deploy.matrix.enable = true to run one \
-         here, or services.hyperhive.swarm.matrix.apiUrl to point at an existing one, before \
-         provisioning matrix users"
+        "no matrix homeserver configured — set services.hyperhive.swarm.matrix.apiUrl (it defaults \
+         to the swarm.matrix.gatewayHost vhost, and is null when that is) before provisioning \
+         matrix users"
     )
 }