make squid's allowed domains editable at runtime in the swarm ui

nix/module-eval/bao-controller.nix

@@ -249,6 +249,20 @@ let
             controllerNoStore
           ];
     }
+    {
+      # The allow-list route refuses the names squid already allows everyone.
+      # The list the controller is handed is the hive module's default, from
+      # one file; the second clause is the control that the default is not empty.
+      name = "the controller is handed the base list squid defaults to";
+      ok =
+        let
+          base = baoControllerHere.services.hyperhive.squid.baseAllowedDomains;
+        in
+        base != [ ]
+        &&
+          baoControllerHere.systemd.services.swarm-controller.environment.SWARM_CONTROLLER_SQUID_BASE_DOMAINS
+          == lib.concatStringsSep " " base;
+    }
     {
       # A hive's cert-auth role carries the authority by value, so the daemon
       # has to be handed the file rather than a path into the store's own