make squid's allowed domains editable at runtime in the swarm ui

nix/host-modules/swarm-controller.nix

@@ -864,6 +864,14 @@ in
         # token is in the store, written by `swarm-bao-grafana-controller-token`
         # on Grafana's host.
         SWARM_CONTROLLER_GRAFANA_URL = "https://${swarmCfg.grafana.domain}";
+        # The names squid allows every authenticated agent by default. The
+        # allow-list route refuses them as entries
+        # (swarm-controller/src/egress_allow.rs). A hive that overrides
+        # `squid.baseAllowedDomains` is not reflected here; its hive-c0re
+        # skips the entries its own list covers.
+        SWARM_CONTROLLER_SQUID_BASE_DOMAINS = lib.concatStringsSep " " (
+          import ./lib/squid-base-domains.nix
+        );
       }
       // queueEnv
       // forgeEnv