swarm-bao: ship the store's logs and metrics

The store declared no journald units and served no metrics: nothing in
`swarm-bao.nix` mentioned either, while every sibling swarm service
declares both.

Metrics get their own loopback listener rather than a flag on the API
one, and that follows from what a scraper can express rather than from
taste: `swarm.otel.scrapeTargets` is `host:port`, plaintext and with no
credential, while the API listener is TLS and demands a client
certificate once a client CA is set. `metrics_only` narrows the new
listener to the metrics path; `prometheus_retention_time` is what serves
the endpoint at all.

Measured against openbao 2.6.2 before writing any of it: the metrics
path answers 200 on such a listener *while the node is sealed and
uninitialised*, 503 on the API listener, and 404 for a non-metrics path
on the metrics listener.

The listener exists only where a collector does — it is unauthenticated
by design for now, and an endpoint with no reader would be exposure
bought for nothing.

The port cannot be the API port + 1: openbao derives every listener's
cluster address as its own port plus one, so that number is already
taken. An assertion says so, since the failure is otherwise a race with
no log line.

Journald units are declared by the module that defines each unit, not
gathered here, matching the option's own rule — a name nothing defines
is silently ignored, so a central list would read as coverage on hives
that have neither glue module.

Refs #3849

nix/module-eval.nix

@@ -109,6 +109,17 @@ let
     deploy.bao.enable = true;
     deploy.bao.extraListenAddresses = [ "10.0.0.1" ];
   };
+  # The store with and without a collector on the same host. `scrapeTargets`
+  # is only ever read by a local collector, so the metrics endpoint is a
+  # function of the pairing rather than of the store.
+  baoWithCollector = hive {
+    deploy.bao.enable = true;
+    deploy.swarm-otel.enable = true;
+  };
+  baoNoCollector = hive {
+    deploy.bao.enable = true;
+    deploy.swarm-otel.enable = false;
+  };
 
   # The config file openbao parses, not the nix that produces it: a setting it
   # requires is absent here without anything in the module system minding, so
@@ -286,6 +297,26 @@ let
       name = "a declared extra address renders a second listener beside loopback";
       ok = builtins.length (builtins.attrNames (baoSettings baoTwoAddresses).listener) == 2;
     }
+    {
+      # Retention is what serves the endpoint at all, so the listener alone
+      # would be a port that answers 404.
+      name = "a store beside a collector serves metrics on its own listener";
+      ok =
+        let
+          s = baoSettings baoWithCollector;
+        in
+        s.listener ? metrics && (s.telemetry.prometheus_retention_time or "0s") != "0s";
+    }
+    {
+      # Absence arm. Unauthenticated by design, so it must not exist where
+      # nothing reads it.
+      name = "a store with no collector beside it serves no metrics";
+      ok =
+        let
+          s = baoSettings baoNoCollector;
+        in
+        !(s.listener ? metrics) && !(s ? telemetry);
+    }
   ];
 
   bad = builtins.filter (c: !c.ok) cases;