hive-forge, hive-matrix: forward each container's journal to the swarm collector

Each container now runs the journal forwarder the CI runner's, Grafana's and
the log store's containers run, pushing to a receiver of its own on the swarm
collector (serviceProducers hive-forge and hive-matrix). Each authenticates as
a new machine OIDC client of its own (swarm.forge.otel.clientId,
swarm.matrix.otel.clientId), registered by a glue file wherever authelia runs,
minted by authelia and published to the store by the secret publisher. The
forge's and the homeserver's browser login clients are unchanged. The client
ids are swarm-forge-collector and swarm-matrix-collector, not
hive-<x>-collector, which is the client id a hive named <x>-collector gets.

The fetch unit inside each container reads the client secret with the store
identity the host already holds for that service. The forge publisher's leaf
is handed into the forge container as an nspawn system credential, as the
grafana and log store containers do. matrix-ctl's leaf is already bound into
the homeserver's container, so its forwarder reads it at those paths, as
swarm-matrix-appservice-publish does; with no matrix-ctl identity the
homeserver's forwarder is off. Each of the two policies gains one read stanza
on its forwarder's client path. The host units that use those identities are
unchanged.

The two containers drop --link-journal=host, and the host collector stops
reading them.

nix/host-modules/swarm-secret-publisher.nix

@@ -98,11 +98,14 @@ let
     hyperhiveCfg.swarm.builder.clientId
     # The claude login minter, which reads it itself inside its container.
     hyperhiveCfg.swarm.claude-login.clientId
-    # The journal forwarders in the CI runner's, Grafana's and the log store's
-    # containers, each reading it inside its container.
+    # The journal forwarders in the CI runner's, Grafana's, the log store's,
+    # the forge's and the homeserver's containers, each reading it inside its
+    # container.
     hyperhiveCfg.swarm.ci-runner.otel.clientId
     hyperhiveCfg.swarm.grafana.otel.clientId
     hyperhiveCfg.swarm.victorialogs.otel.clientId
+    hyperhiveCfg.swarm.forge.otel.clientId
+    hyperhiveCfg.swarm.matrix.otel.clientId
   ];
 
   # The swarm controller's OIDC client, which it reads back from the store