swarm options: no swarm.* value depends on a deploy option or this host's hive

- swarm.serviceDomains lists every swarm service name on every host. The
  store's issuing role is built from it, so the store now admits a leaf
  for grafana, metrics, otel, logs, the bao UI and the apex whichever host
  runs the store. Each gateway's own leaf stays narrowed by
  localServiceDomains.
- swarm.matrix.apiUrl defaults to http://<swarm.matrix.gatewayHost>
  (null when gatewayHost is null) instead of loopback on the matrix host.
- The authelia vhost proxies /bridge/ to swarm-authelia-bridge with the
  prefix stripped, and deploy.swarm-controller.authBridgeUrl defaults to
  ${swarm.authelia.url}/bridge on every host. swarm.authelia.bridgeUrl is
  removed.
- swarm-authelia-bridge admits only swarm-controller's OIDC client on
  every request (403 for any other active token), configured by
  SWARM_AUTHELIA_BRIDGE_CONTROLLER_CLIENT_ID (renamed from
  ..._OPERATOR_READER_CLIENT_ID, which gated ListOperators alone).
- swarm.peerHives is removed; swarm-wireguard.nix filters this host's own
  hive out of swarm.hives itself.

Closes #4933

nix/host-modules/swarm-controller.nix

@@ -587,17 +587,14 @@ in
 
     authBridgeUrl = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = if deployCfg.authelia.enable then autheliaCfg.bridgeUrl else null;
-      defaultText = lib.literalExpression ''
-        authelia's own `bridgeUrl` when this host also runs
-        `swarm-authelia`, else null
-      '';
-      example = "http://127.0.0.1:9092";
+      default = "${autheliaCfg.url}/bridge";
+      defaultText = lib.literalExpression ''"''${services.hyperhive.swarm.authelia.url}/bridge"'';
+      example = "https://auth.example.com/bridge";
       description = ''
         Where `swarm-authelia-bridge` (the only writer of authelia's
-        users database) answers — see that option's own doc comment for
-        the cross-host caveat, since this default is only correct when
-        this host also runs `swarm-authelia`.
+        users database) answers. The default is the `/bridge/` location
+        on the authelia vhost, the same address from every host whether
+        or not it runs `swarm-authelia`; the daemon appends `/requests`.
 
         No new credential to configure: the bearer token presented to
         the bridge is minted from THIS daemon's own existing queue OIDC
@@ -879,8 +876,7 @@ in
       environment = {
         SWARM_CONTROLLER_SOCKET = deployCfg.swarm-controller.socketPath;
         # The swarm's hive directory, JSON-encoded — the full directory
-        # (this daemon has no "self" hive to exclude, unlike
-        # `swarm.peerHives`, `swarm.hives` minus this hive) rather than
+        # (this daemon has no "self" hive to exclude) rather than
         # peers-minus-self. Consumed by `GET /api/hives`
         # (swarm-controller/src/main.rs::load_hives).
         # The one blacklist of names an agent may not take, shared verbatim