feat(#3265): swarm metrics UI as a Grafana container

Second half of the metrics pair: a `swarm-grafana` container beside the
VictoriaMetrics store, provisioned with it as the default datasource and
fronted by the gateway on its own swarm-sibling name.

Behind swarm SSO, per the operator's call on #3265. The authelia client
and Grafana's callback URL both derive from `domain`, so the exact-match
string authelia checks cannot drift from the one Grafana sends. The
minted secret is delivered host-side (both container trees are only
addressable there) and reaches Grafana as a `$__file{}` reference rather
than a value, so it never enters the store.

The login form is disabled whenever SSO is configured: Grafana ships an
`admin`/`admin` account and this vhost is on the public gateway.

nix/host-modules/default.nix

@@ -26,6 +26,7 @@
     ./swarm-ca.nix
     ./swarm-nats.nix
     ./swarm-controller.nix
+    ./swarm-grafana.nix
     ./swarm-snapshot-store.nix
     ./swarm-ui.nix
     ./swarm-victoriametrics.nix