swarm options: no swarm.* value depends on a deploy option or this host's hive

- swarm.serviceDomains lists every swarm service name on every host. The
  store's issuing role is built from it, so the store now admits a leaf
  for grafana, metrics, otel, logs, the bao UI and the apex whichever host
  runs the store. Each gateway's own leaf stays narrowed by
  localServiceDomains.
- swarm.matrix.apiUrl defaults to http://<swarm.matrix.gatewayHost>
  (null when gatewayHost is null) instead of loopback on the matrix host.
- The authelia vhost proxies /bridge/ to swarm-authelia-bridge with the
  prefix stripped, and deploy.swarm-controller.authBridgeUrl defaults to
  ${swarm.authelia.url}/bridge on every host. swarm.authelia.bridgeUrl is
  removed.
- swarm-authelia-bridge admits only swarm-controller's OIDC client on
  every request (403 for any other active token), configured by
  SWARM_AUTHELIA_BRIDGE_CONTROLLER_CLIENT_ID (renamed from
  ..._OPERATOR_READER_CLIENT_ID, which gated ListOperators alone).
- swarm.peerHives is removed; swarm-wireguard.nix filters this host's own
  hive out of swarm.hives itself.

Closes #4933

nix/module-eval/core-toggle.nix

@@ -197,6 +197,22 @@ let
         && !(lib.hasInfix "auth.t.local" u)
         && lib.elem "auth.t.local" s;
     }
+    {
+      # The store's issuing role is built from this list on the store's host,
+      # so it cannot depend on which services the evaluating host runs. The
+      # last conjunct is the control: grafana runs on neither `bare` nor the
+      # forge host, and is still listed.
+      name = "the swarm's service names are the same on hosts running different services";
+      ok =
+        let
+          s = h: h.services.hyperhive.swarm.serviceDomains;
+        in
+        s (hive {
+          deploy.forgejo.enable = true;
+        }) == s bare
+        && s allLocal == s bare
+        && lib.elem "grafana.t.local" (s bare);
+    }
     {
       # The narrowing's floor: no names left means no request, rather than a
       # request for an empty SAN set that the store would refuse. Its own

nix/module-eval/nats-authelia.nix

@@ -264,19 +264,33 @@ let
         && !(lib.hasInfix ''echo "users: {}"'' s);
     }
     {
-      # The bridge refuses its operator list to every client but the one
-      # named here, so this has to be the client the controller authenticates
-      # as. A drift is a controller whose admin sync is refused every pass.
-      name = "the authelia bridge answers its operator list to the controller's client only";
+      # The bridge refuses every client but the one named here, so this has
+      # to be the client the controller authenticates as. A drift is a
+      # controller whose every bridge call is refused.
+      name = "the authelia bridge answers the controller's client only";
       ok =
         let
           env =
             autheliaColocated.containers.swarm-authelia.config.systemd.services.swarm-authelia-bridge.environment;
         in
-        env.SWARM_AUTHELIA_BRIDGE_OPERATOR_READER_CLIENT_ID
+        env.SWARM_AUTHELIA_BRIDGE_CONTROLLER_CLIENT_ID
         == autheliaColocated.services.hyperhive.swarm.controller.queueClientId
         && env.SWARM_AUTHELIA_BRIDGE_OPERATOR_GROUP == "admins";
     }
+    {
+      # One address from every host, and a location the IdP host serves: a
+      # controller off the authelia host has no other way to the bridge.
+      name = "the auth bridge address is the authelia vhost's /bridge/ on every host";
+      ok =
+        let
+          url = h: h.services.hyperhive.deploy.swarm-controller.authBridgeUrl;
+          authelia = autheliaColocated.services.hyperhive.swarm.authelia;
+          location = autheliaColocated.services.nginx.virtualHosts.${authelia.domain}.locations."/bridge/";
+        in
+        url autheliaNotColocated == "${autheliaNotColocated.services.hyperhive.swarm.authelia.url}/bridge"
+        && url autheliaColocated == url autheliaNotColocated
+        && location.proxyPass == "http://127.0.0.1:${toString authelia.bridgePort}/";
+    }
     {
       # Config NAMES the IdP; it never computes where the IdP is. Both arms
       # matter together: the address is the swarm's name on a hive that runs