nix: follow-ups from the service/deploy split

- swarm.victoriametrics.port: the description states why the listener is
  loopback-only instead of pointing "below" at text in another file.
- authelia: the deploy half derives its unit and instance names from
  swarm.authelia.unit, so the instance is spelled once, in
  swarm-authelia-service.nix.
- authelia: the tokenEndpointAuthMethod and bearerAuthz descriptions name
  the obligations the authelia host asserts instead of "below"; the
  swarm-authelia.nix header describes that file only.
- module-eval-swarm-otel-core: swarm.otel.audience must contain both store
  push URLs the collector's exporters use and request tokens for.

Refs #3742

nix/module-eval/swarm-otel-core.nix

@@ -139,6 +139,30 @@ let
         && lib.hasInfix "metrics.t.local" m
         && lib.hasInfix "logs.t.local" l;
     }
+    {
+      # `swarm.otel.audience` is built in ../host-modules/swarm-otel-service.nix,
+      # the push URLs the exporters use in ../host-modules/swarm-otel.nix. A URL
+      # the registration lacks is refused at the token endpoint with
+      # `invalid_target`, so every push fails while the collector reports
+      # healthy.
+      name = "the collector's registered audiences include both store push URLs it requests";
+      ok =
+        let
+          s = otelSettings otelBaoWithAuthelia;
+          registered = otelBaoWithAuthelia.services.hyperhive.swarm.otel.audience;
+          withoutQuery = url: lib.head (lib.splitString "?" url);
+          pushUrls = [
+            s.exporters."otlphttp/victoriametrics".metrics_endpoint
+            (withoutQuery s.exporters."otlphttp/victorialogs".logs_endpoint)
+          ];
+          requested = map (n: s.extensions."oauth2client/${n}".endpoint_params.audience) [
+            "victoriametrics"
+            "victorialogs"
+          ];
+        in
+        lib.all (u: builtins.elem u registered) pushUrls
+        && lib.sort lib.lessThan requested == lib.sort lib.lessThan pushUrls;
+    }
     {
       # `_HOSTNAME` cannot separate machines on its own: a hostname is a
       # config value two of them can share, and then every stream for a unit