fix(#3384): source the queue policy's principals from the modules that mint them

The auth-callout responder decides what an admitted client may publish
from two strings: the prefix marking a hive client, and the client id
allowed to read every hive's key. Both were literals in three places --
swarm-authelia.nix mints "hive-${name}", swarm-controller.nix defines
"swarm-controller", and the responder carried its own copies as clap
defaults because swarm-nats.nix passed neither.

Each producer now publishes its value as a readOnly option and the
responder's ExecStart reads them, so the agreement is one evaluation
rather than three strings that happen to be equal. Same pattern the
module already uses for `--account`, and the same argument
swarm-authelia.nix gives for publishing `machine` and `unit`.

Worth the change because the failure is silent and misattributed:
rename either principal and the responder starts denying the one that
stopped matching, a denial reaches a NATS client as a timeout rather
than an error, and a hive that is refused looks exactly like a hive
that has not reported yet.

nix/host-modules/swarm-controller.nix

@@ -41,7 +41,7 @@ let
   # belongs to the responder. One identity per principal — the rule is that
   # a principal's credentials all derive from the same identity, not that
   # the swarm has one.
-  queueClientId = "swarm-controller";
+  queueClientId = cfg.queueClientId;
 
   # `LoadCredential` and not a copy-oneshot, which is where this deliberately
   # differs from the callout responder: that one delivers INTO a container,
@@ -114,6 +114,25 @@ let
 in
 {
   options.services.hyperhive.swarm.controller = {
+    queueClientId = lib.mkOption {
+      type = lib.types.str;
+      readOnly = true;
+      default = "swarm-controller";
+      description = ''
+        The OAuth2 client id the controller presents to the swarm queue.
+        Read-only: it is what this module registers, published so the
+        auth-callout responder can be told which client may read every
+        hive's key without repeating the string.
+
+        The responder decides that from a client id, and a client id it
+        does not recognise is **denied**. A denial reaches a NATS client
+        as a timeout rather than an error, and a controller that cannot
+        read looks exactly like a swarm where no hive has reported yet —
+        so a drift between these two spellings is invisible at the point
+        it is introduced and misattributed everywhere it shows up.
+      '';
+    };
+
     enable = lib.mkOption {
       type = lib.types.bool;
       default = false;