swarm-bao: ship the store's logs and metrics

The store declared no journald units and served no metrics: nothing in
`swarm-bao.nix` mentioned either, while every sibling swarm service
declares both.

Metrics get their own loopback listener rather than a flag on the API
one, and that follows from what a scraper can express rather than from
taste: `swarm.otel.scrapeTargets` is `host:port`, plaintext and with no
credential, while the API listener is TLS and demands a client
certificate once a client CA is set. `metrics_only` narrows the new
listener to the metrics path; `prometheus_retention_time` is what serves
the endpoint at all.

Measured against openbao 2.6.2 before writing any of it: the metrics
path answers 200 on such a listener *while the node is sealed and
uninitialised*, 503 on the API listener, and 404 for a non-metrics path
on the metrics listener.

The listener exists only where a collector does — it is unauthenticated
by design for now, and an endpoint with no reader would be exposure
bought for nothing.

The port cannot be the API port + 1: openbao derives every listener's
cluster address as its own port plus one, so that number is already
taken. An assertion says so, since the failure is otherwise a race with
no log line.

Journald units are declared by the module that defines each unit, not
gathered here, matching the option's own rule — a name nothing defines
is silently ignored, so a central list would read as coverage on hives
that have neither glue module.

Refs #3849

nix/host-modules/glue-matrix-bao-token.nix

@@ -54,6 +54,11 @@ let
 in
 {
   config = lib.mkIf (hyperhiveCfg.enable && haveClientIdentity && deployCfg.matrix.enable) {
+    # Same rule as the unit's own gate: this reader exists on a host that has a
+    # client identity and a homeserver, which is not every host that runs the
+    # store, so the store's module cannot name it.
+    services.hyperhive.swarm.otel.journaldUnits = [ "swarm-bao-matrix-token" ];
+
     systemd.services.swarm-bao-matrix-token = {
       description = "fetch the matrix registration token from the swarm secret store";
       # Every one of these names a unit that exists only where the store runs.