keep authelia's oidc client secrets in the store, not on disk

The mint creates each client's secret in the swarm secret store and writes only the digest to disk. It mints only when the store answers and holds none. A new unit moves the plaintext files an earlier release left into the store and removes each once the store holds the same value. The bridge reads its secret from the store into /run before each start. The secret publisher unit and its path unit are gone.

nix/host-modules/hive-forge/default.nix

@@ -40,7 +40,7 @@ let
   # root. Removed by the tmpfiles rule below.
   oldOidcSecretPath = "/var/lib/nixos-containers/hive-forge/var/lib/forgejo-oidc/${cfg.sso.clientId}.secret";
 
-  # Where swarm-secret-publish in authelia's container leaves this client's
+  # Where authelia's mint, in its container, stores this client's
   # secret.
   # The forge publisher's store role grants read on this path.
   oidcStorePath = "secret/swarm/services/${cfg.sso.clientId}/oidc/client";

nix/host-modules/hive-forge/service.nix

@@ -164,8 +164,8 @@ in
         Read-only because three hosts have to agree on it: authelia
         registers the client (`glue-forge-otel-oidc-client.nix`), the
         swarm collector admits it on the container's receiver
-        (`swarm.otel.serviceProducers`), and the secret publisher carries
-        its secret to the store.
+        (`swarm.otel.serviceProducers`), and authelia's mint stores
+        its secret in the store.
       '';
     };
   };