swarm options: no swarm.* value depends on a deploy option or this host's hive

- swarm.serviceDomains lists every swarm service name on every host. The
  store's issuing role is built from it, so the store now admits a leaf
  for grafana, metrics, otel, logs, the bao UI and the apex whichever host
  runs the store. Each gateway's own leaf stays narrowed by
  localServiceDomains.
- swarm.matrix.apiUrl defaults to http://<swarm.matrix.gatewayHost>
  (null when gatewayHost is null) instead of loopback on the matrix host.
- The authelia vhost proxies /bridge/ to swarm-authelia-bridge with the
  prefix stripped, and deploy.swarm-controller.authBridgeUrl defaults to
  ${swarm.authelia.url}/bridge on every host. swarm.authelia.bridgeUrl is
  removed.
- swarm-authelia-bridge admits only swarm-controller's OIDC client on
  every request (403 for any other active token), configured by
  SWARM_AUTHELIA_BRIDGE_CONTROLLER_CLIENT_ID (renamed from
  ..._OPERATOR_READER_CLIENT_ID, which gated ListOperators alone).
- swarm.peerHives is removed; swarm-wireguard.nix filters this host's own
  hive out of swarm.hives itself.

Closes #4933

swarm-authelia-bridge/README.md

@@ -25,18 +25,17 @@ simply owns the file it writes. No elevated privilege anywhere.
   `ListOperators` (the operator group's usernames).
 - Bearer-authenticated via authelia's own OIDC token introspection (RFC
   7662), against `swarm-controller`'s **existing** machine-client identity
-  (already minted for the queue connection) — no new credential. The two
-  agent verbs admit any active token. ⚠️ `ListOperators` admits only the
-  client named by `SWARM_AUTHELIA_BRIDGE_OPERATOR_READER_CLIENT_ID`
-  (`swarm-controller`'s) and answers every other active token `403`:
-  authelia issues machine tokens to every hive and its agents too.
+  (already minted for the queue connection) — no new credential. ⚠️ Every
+  request admits only the client named by
+  `SWARM_AUTHELIA_BRIDGE_CONTROLLER_CLIENT_ID` (`swarm-controller`'s) and
+  answers every other active token `403`: authelia issues machine tokens to
+  every hive and its agents too.
 - No restart of authelia after a write — relies on
   `authentication_backend.file.watch`, confirmed working against the
   pinned 4.39.20 build during this design work.
-- Network-facing rather than unix-socket-only: `swarm-authelia`'s container
-  shares the host netns, so the same listener serves both a co-located
-  `swarm-controller` (loopback) and a split-host one (bind wider + firewall)
-  with no separate transport.
+- Listens on loopback. The authelia vhost proxies `/bridge/` to it with
+  the prefix stripped, so `swarm-controller` on any host calls
+  `https://<swarm.authelia.domain>/bridge/requests`.
 
 ## One store, two writers