retry the authelia mint and the appservice render until the store answers, and let tuwunel retry

nix/host-modules/lib/oidc-client-secrets.nix

@@ -11,8 +11,10 @@
 # secret behind it. A store that cannot be read never mints, because a second
 # secret would rotate the first.
 #
-# Return statuses: 0 done, 1 retry later (the store could not answer, or a
-# digest could not be computed).
+# Return statuses: 0 done, 1 retry later (the store could not answer and the
+# client has no digest, or a digest could not be computed), 2 the client keeps
+# its digest but the store could not be read, so the caller finishes its work
+# from the digests and then retries.
 #
 # Pure function — NOT a NixOS module. Call it after `./store-seeded-secret.nix`
 # and `./atomic-write-secret.nix`, with `store_init` and `store_login` run and
@@ -92,7 +94,7 @@
       if [ -s "$dig" ]; then
         chmod 0600 "$dig"
         echo "oidc client $id: the store cannot be read; keeping its digest" >&2
-        return 0
+        return 2
       fi
       echo "oidc client $id: the store cannot be read and there is no digest; not minting" >&2
       return 1