nix: follow-ups from the service/deploy split

- swarm.victoriametrics.port: the description states why the listener is
  loopback-only instead of pointing "below" at text in another file.
- authelia: the deploy half derives its unit and instance names from
  swarm.authelia.unit, so the instance is spelled once, in
  swarm-authelia-service.nix.
- authelia: the tokenEndpointAuthMethod and bearerAuthz descriptions name
  the obligations the authelia host asserts instead of "below"; the
  swarm-authelia.nix header describes that file only.
- module-eval-swarm-otel-core: swarm.otel.audience must contain both store
  push URLs the collector's exporters use and request tokens for.

Refs #3742

nix/host-modules/swarm-victoriametrics-service.nix

@@ -47,9 +47,11 @@ in
       type = lib.types.port;
       default = 8428;
       description = ''
-        Port VictoriaMetrics listens on, bound to loopback only (see
-        below). Upstream's own default, kept so an operator reading
-        VictoriaMetrics documentation finds what they expect.
+        Port VictoriaMetrics listens on, bound to loopback only on the
+        host that runs it: its write endpoint is unauthenticated, so the
+        gateway's vhost there is the only route to it. Upstream's own
+        default, kept so an operator reading VictoriaMetrics
+        documentation finds what they expect.
       '';
     };