swarm options: no swarm.* value depends on a deploy option or this host's hive

- swarm.serviceDomains lists every swarm service name on every host. The
  store's issuing role is built from it, so the store now admits a leaf
  for grafana, metrics, otel, logs, the bao UI and the apex whichever host
  runs the store. Each gateway's own leaf stays narrowed by
  localServiceDomains.
- swarm.matrix.apiUrl defaults to http://<swarm.matrix.gatewayHost>
  (null when gatewayHost is null) instead of loopback on the matrix host.
- The authelia vhost proxies /bridge/ to swarm-authelia-bridge with the
  prefix stripped, and deploy.swarm-controller.authBridgeUrl defaults to
  ${swarm.authelia.url}/bridge on every host. swarm.authelia.bridgeUrl is
  removed.
- swarm-authelia-bridge admits only swarm-controller's OIDC client on
  every request (403 for any other active token), configured by
  SWARM_AUTHELIA_BRIDGE_CONTROLLER_CLIENT_ID (renamed from
  ..._OPERATOR_READER_CLIENT_ID, which gated ListOperators alone).
- swarm.peerHives is removed; swarm-wireguard.nix filters this host's own
  hive out of swarm.hives itself.

Closes #4933

nix/host-modules/swarm-wireguard.nix

@@ -114,12 +114,14 @@
     networking.wireguard.interfaces =
       let
         wgCfg = config.services.hyperhive.deploy.wireguard;
-        # `peerHives` is `swarm.hives` minus this hive (../swarm.nix) —
-        # a mesh that included our own entry would configure a tunnel to
-        # ourselves.
+        # `swarm.hives` minus this host's own hive: a mesh that included
+        # our own entry would configure a tunnel to ourselves.
         meshPeers = lib.filterAttrs (
-          _: p: p.wireguardPublicKey != null && p.wireguardAddress != null
-        ) config.services.hyperhive.swarm.peerHives;
+          name: p:
+          name != config.services.hyperhive.hiveName
+          && p.wireguardPublicKey != null
+          && p.wireguardAddress != null
+        ) config.services.hyperhive.swarm.hives;
       in
       {
         wg-hive = {