matrix: activationScript pre-creates token + share reqwest client across sweep (argus #565 nits)

nix/modules/hive-matrix.nix

@@ -181,6 +181,25 @@ in
       }
     ];
 
+    # Generate the registration token at system activation time, BEFORE
+    # the hive-matrix container would otherwise start with an empty
+    # bind-mount target (argus nit on #565: nspawn creates an empty
+    # file when the host path is missing, tuwunel reads it as
+    # `registration_token_file=""` and rejects every registration
+    # until the next restart). Idempotent: only writes when the file
+    # doesn't exist. 32-byte hex = 64 chars, same shape hive-c0re's
+    # `matrix::ensure_register_token` would produce.
+    system.activationScripts.hive-matrix-register-token = lib.stringAfter [ "var" ] ''
+      tokenFile=${lib.escapeShellArg (toString cfg.registrationTokenFile)}
+      if [ ! -s "$tokenFile" ]; then
+        mkdir -p "$(dirname "$tokenFile")"
+        head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n' > "$tokenFile"
+        echo >> "$tokenFile"
+        chmod 600 "$tokenFile"
+        echo "hive-matrix: generated registration token at $tokenFile"
+      fi
+    '';
+
     containers.hive-matrix = {
       autoStart = true;
       ephemeral = false;