feat(#3125): reshape the hive-to-swarm OTEL hop by domain

Drops swarm.otel.url (a loopback default an operator had to override on a
split host) in favor of swarm.otel.domain -- the same
gateway.localNames + nginx-vhost-through-the-gateway shape every other
swarm service (authelia, grafana, victoriametrics, ui) already uses. The
hive tier's exporter now reaches it as https://<domain> unconditionally,
resolved locally by dnsmasq on a co-located host and over the real network
otherwise, instead of a config knob nobody sets until they hit the silent
drop.

Costs CA trust on the hive tier: otel.nix wires
lib/hive-ca-trust.nix's trustBundle with hostUnit = true on the
opentelemetry-collector host unit, the same flag #3441/#3442 added for
swarm-controller and hive-c0re.

mara, #3125 comment 58363: "go c".

nix/host-modules/swarm-required-services.nix

@@ -74,7 +74,7 @@ in
     # The collector that feeds the pair above, and the only tier holding
     # the upstream credential. Same rule as the rest: once per swarm,
     # optional, and a hive that is not the service host is a *client* of
-    # it (`swarm.otel.url`) rather than a second one.
+    # it (by name, `swarm.otel.domain`) rather than a second one.
     otel.enable = lib.mkDefault swarmCfg.enableRequiredServices;
   };