fix(#3384): source the queue policy's principals from the modules that mint them

The auth-callout responder decides what an admitted client may publish
from two strings: the prefix marking a hive client, and the client id
allowed to read every hive's key. Both were literals in three places --
swarm-authelia.nix mints "hive-${name}", swarm-controller.nix defines
"swarm-controller", and the responder carried its own copies as clap
defaults because swarm-nats.nix passed neither.

Each producer now publishes its value as a readOnly option and the
responder's ExecStart reads them, so the agreement is one evaluation
rather than three strings that happen to be equal. Same pattern the
module already uses for `--account`, and the same argument
swarm-authelia.nix gives for publishing `machine` and `unit`.

Worth the change because the failure is silent and misattributed:
rename either principal and the responder starts denying the one that
stopped matching, a denial reaches a NATS client as a timeout rather
than an error, and a hive that is refused looks exactly like a hive
that has not reported yet.

nix/host-modules/swarm-nats.nix

@@ -9,6 +9,10 @@ let
   autheliaCfg = config.services.hyperhive.swarm.authelia;
   autheliaUrl = autheliaCfg.url;
   networkCfg = config.services.hyperhive.network;
+  # Read even when the controller runs on a different host: what is needed
+  # is the client id that module *declares*, which is the same string
+  # everywhere, not whether the daemon happens to be enabled here.
+  controllerCfg = config.services.hyperhive.swarm.controller;
 
   # The account the callout responder authenticates as, and the account
   # authorized clients are placed in. Two accounts rather than one: an
@@ -531,6 +535,15 @@ in
                 # be the same string — which is why both come from one let.
                 "--account ${lib.escapeShellArg clientAccount}"
                 "--introspection-url ${lib.escapeShellArg introspectionUrl}"
+                # Both of these name a principal some OTHER module mints,
+                # so both are read out of that module rather than spelled
+                # again here — same argument as `--account` above, one
+                # level wider. The responder denies a client id it does
+                # not recognise, and a NATS denial arrives as a timeout,
+                # so a drift here is silent at the point of change and
+                # misattributed at the point of failure.
+                "--hive-client-prefix ${lib.escapeShellArg autheliaCfg.hiveClientPrefix}"
+                "--reader-client ${lib.escapeShellArg controllerCfg.queueClientId}"
               ];
               # Every credential arrives by `LoadCredential` and is named
               # on the command line only as a **path** — `argv` is