let the operator's oidc login write the cache's tokens and facts

nix/host-modules/swarm-bao.nix

@@ -777,18 +777,28 @@ let
   # `read`. The UI needs no `sys/` grant on top:
   # `sys/internal/ui/mounts` lists any mount the token holds a capability
   # under, and the rest it calls is in the `default` policy.
+  #
+  # The cache's five leaves are where an external cache is configured, and
+  # where the operator replaces the in-swarm cache's tokens; its host units
+  # create them only while none is stored. `atticJwtLeaf` is left out: a new
+  # signing key invalidates both tokens.
+  operatorWritableLeaves = [
+    classifierApiKeyLeaf
+    classifierAcpKeyLeaf
+    atticPushTokenLeaf
+  ]
+  ++ atticFactLeaves;
   operatorViewerPolicyName = "swarm-operator-viewer";
   operatorViewerPolicyText = ''
     path "${credentialMountPath}/metadata/*" {
       capabilities = ["list", "read"]
     }
-    path "${credentialMountPath}/data/${classifierApiKeyLeaf}" {
+  ''
+  + lib.concatMapStrings (leaf: ''
+    path "${credentialMountPath}/data/${leaf}" {
       capabilities = ["create", "update"]
     }
-    path "${credentialMountPath}/data/${classifierAcpKeyLeaf}" {
-      capabilities = ["create", "update"]
-    }
-  '';
+  '') operatorWritableLeaves;
 
   # authelia's operator group (`operatorGroup` in ./swarm-authelia.nix, the
   # group its rule for the UI's vhost admits) → the viewer policy. authelia