swarm options: no swarm.* value depends on a deploy option or this host's hive

- swarm.serviceDomains lists every swarm service name on every host. The
  store's issuing role is built from it, so the store now admits a leaf
  for grafana, metrics, otel, logs, the bao UI and the apex whichever host
  runs the store. Each gateway's own leaf stays narrowed by
  localServiceDomains.
- swarm.matrix.apiUrl defaults to http://<swarm.matrix.gatewayHost>
  (null when gatewayHost is null) instead of loopback on the matrix host.
- The authelia vhost proxies /bridge/ to swarm-authelia-bridge with the
  prefix stripped, and deploy.swarm-controller.authBridgeUrl defaults to
  ${swarm.authelia.url}/bridge on every host. swarm.authelia.bridgeUrl is
  removed.
- swarm-authelia-bridge admits only swarm-controller's OIDC client on
  every request (403 for any other active token), configured by
  SWARM_AUTHELIA_BRIDGE_CONTROLLER_CLIENT_ID (renamed from
  ..._OPERATOR_READER_CLIENT_ID, which gated ListOperators alone).
- swarm.peerHives is removed; swarm-wireguard.nix filters this host's own
  hive out of swarm.hives itself.

Closes #4933

nix/host-modules/hive-c0re/default.nix

@@ -127,9 +127,9 @@ in
     ./options.nix
     ./theme.nix
     # Hive-CA trust for this daemon's outbound TLS. Nothing it is given by
-    # default is https — the forge and matrix URLs resolve to plain http or
-    # loopback, and the queue's TLS is verified against
-    # `HIVE_C0RE_OIDC_CA_FILE` (../hive-tls.nix), not this bundle — so this
+    # default is https — the forge and matrix URLs are plain http, and the
+    # queue's TLS is verified against `HIVE_C0RE_OIDC_CA_FILE`
+    # (../hive-tls.nix), not this bundle — so this
     # changes nothing on an all-local hive. It matters for the split-host
     # shape the options invite: `swarm.matrix.apiUrl`'s own example is
     # `https://matrix.example.com`, and pointing it at another hive's

nix/host-modules/hive-c0re/environment.nix

@@ -180,15 +180,10 @@ in
 // lib.optionalAttrs (config.services.hyperhive.swarm.matrix.apiUrl != null) {
   # Client-server API base hive-c0re uses to provision matrix (register
   # agent users, create the hive space + chat room, invite members).
-  # Supplied by `services.hyperhive.swarm.matrix.apiUrl`, which the matrix
-  # module fills in with its own loopback listener when it is the thing
-  # running tuwunel — and which the operator sets by hand when the
-  # homeserver lives on another machine.
-  #
-  # NOT the agent-facing HIVE_MATRIX_URL above: that one is the gateway
-  # vhost, and it is absent whenever there is no vhost. Reusing it here
-  # would silently stop provisioning on a hive that runs matrix without
-  # one.
+  # Supplied by `services.hyperhive.swarm.matrix.apiUrl`, which defaults to
+  # the same gateway vhost as HIVE_MATRIX_URL above but is its own option,
+  # so an operator can point provisioning elsewhere without changing what
+  # agents are handed.
   HIVE_MATRIX_API_URL = config.services.hyperhive.swarm.matrix.apiUrl;
 }
 // {