nix: follow-ups from the service/deploy split

- swarm.victoriametrics.port: the description states why the listener is
  loopback-only instead of pointing "below" at text in another file.
- authelia: the deploy half derives its unit and instance names from
  swarm.authelia.unit, so the instance is spelled once, in
  swarm-authelia-service.nix.
- authelia: the tokenEndpointAuthMethod and bearerAuthz descriptions name
  the obligations the authelia host asserts instead of "below"; the
  swarm-authelia.nix header describes that file only.
- module-eval-swarm-otel-core: swarm.otel.audience must contain both store
  push URLs the collector's exporters use and request tokens for.

Refs #3742

nix/host-modules/swarm-authelia-service.nix

@@ -12,8 +12,8 @@ let
   swarmDomain = config.services.hyperhive.swarm.domain;
 
   # The unit name upstream's `services.authelia.instances.<name>` derives,
-  # which `unit` publishes. ./swarm-authelia.nix binds the same two names for
-  # the instance it declares, and the two must agree.
+  # which `unit` publishes. ./swarm-authelia.nix reads its instance name back
+  # from `unit`, so this is the one place the instance is spelled.
   instance = "swarm";
   unitName = "authelia-${instance}";
 in
@@ -240,9 +240,10 @@ in
                 method must be *stated*: omitting it is refused with
                 `must be configured as 'client_secret_basic', … but it's
                 configured as` an empty string. The sentence above is
-                true of an ordinary client and false of that one, which
-                is exactly how a reviewer reads this option and concludes
-                the assertion below is wrong.
+                true of an ordinary client and false of that one: the
+                host that runs authelia asserts at evaluation that a
+                `bearerAuthz` client states `client_secret_basic`,
+                `client_secret_jwt` or `private_key_jwt`.
               '';
             };
 
@@ -290,12 +291,14 @@ in
                 one value that is legal here and nothing else.
 
                 ::: {.note}
-                Setting this obliges two other options, and the assertions
-                below enforce it. Authelia checks the same thing, but only
+                Setting this obliges two other options: a non-empty
+                `audience`, and a `tokenEndpointAuthMethod` of
+                `client_secret_basic`, `client_secret_jwt` or
+                `private_key_jwt`. Authelia checks the same thing, but only
                 in its `preStart` validator — which means a violation
                 builds and deploys cleanly and then fails to restart,
-                taking swarm SSO down. The assertions move that to
-                evaluation, where a wrong value costs nothing.
+                taking swarm SSO down. The host that runs authelia asserts
+                both at evaluation, where a wrong value costs nothing.
                 :::
               '';
             };