swarm-bao: enable approle auth method in bootstrap

Adds approle to the auth methods enabled during swarm-bao bootstrap,
using the same idempotent check pattern as cert. No role or policy
is configured yet — those are handled in later slices.

Refs #4386

nix/host-modules/swarm-bao.nix

@@ -1034,6 +1034,11 @@ in
             *) bao auth enable cert ;;
           esac
 
+          case "$mounted" in
+            *'"approle/"'*) ;;
+            *) bao auth enable approle ;;
+          esac
+
           # `certificate=` is the CA, so this role trusts every leaf that
           # CA signed and `allowed_common_names` is the whole narrowing —
           # which is why ./swarm.nix reserves this subject as a hive name,