swarm options: no swarm.* value depends on a deploy option or this host's hive

- swarm.serviceDomains lists every swarm service name on every host. The
  store's issuing role is built from it, so the store now admits a leaf
  for grafana, metrics, otel, logs, the bao UI and the apex whichever host
  runs the store. Each gateway's own leaf stays narrowed by
  localServiceDomains.
- swarm.matrix.apiUrl defaults to http://<swarm.matrix.gatewayHost>
  (null when gatewayHost is null) instead of loopback on the matrix host.
- The authelia vhost proxies /bridge/ to swarm-authelia-bridge with the
  prefix stripped, and deploy.swarm-controller.authBridgeUrl defaults to
  ${swarm.authelia.url}/bridge on every host. swarm.authelia.bridgeUrl is
  removed.
- swarm-authelia-bridge admits only swarm-controller's OIDC client on
  every request (403 for any other active token), configured by
  SWARM_AUTHELIA_BRIDGE_CONTROLLER_CLIENT_ID (renamed from
  ..._OPERATOR_READER_CLIENT_ID, which gated ListOperators alone).
- swarm.peerHives is removed; swarm-wireguard.nix filters this host's own
  hive out of swarm.hives itself.

Closes #4933

nix/host-modules/hive-matrix-service.nix

@@ -10,7 +10,6 @@
 let
   cfg = config.services.hyperhive.swarm.matrix;
   swarmDomain = config.services.hyperhive.swarm.domain;
-  deployCfg = config.services.hyperhive.deploy;
 in
 {
   options.services.hyperhive.swarm.matrix = {
@@ -65,11 +64,10 @@ in
 
     apiUrl = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = if deployCfg.matrix.enable then "http://127.0.0.1:${toString cfg.httpPort}" else null;
+      default = if cfg.gatewayHost == null then null else "http://${cfg.gatewayHost}";
       defaultText = lib.literalExpression ''
-        if services.hyperhive.deploy.matrix.enable
-        then "http://127.0.0.1:''${toString services.hyperhive.swarm.matrix.httpPort}"
-        else null
+        if services.hyperhive.swarm.matrix.gatewayHost == null then null
+        else "http://''${services.hyperhive.swarm.matrix.gatewayHost}"
       '';
       example = "https://matrix.example.com";
       description = ''
@@ -79,12 +77,10 @@ in
         `hyperhive.matrix.url`, which is the gateway vhost handed to
         each agent's `hive-matrix-daemon`.
 
-        Defaults to the loopback listener **only when this module is the
-        thing running tuwunel** — in that case the address is not a
-        guess, it is where this module just put the container. Set it
-        explicitly (with `enable = false`) when the homeserver runs on
-        another machine; "everything on one host" is a special case of
-        the full deployment, not the assumption.
+        Defaults to the homeserver's gateway vhost (`gatewayHost`), the
+        same name on every hive whichever host runs tuwunel, and `null`
+        when there is no vhost. Set it explicitly when the homeserver is
+        reachable only some other way.
 
         `null` means hive-c0re has no homeserver to provision against
         and matrix provisioning no-ops. There is deliberately no