forge: fetch the OIDC client secret from bao instead of a host-side copy

The forge's login source read its OIDC client secret from a file that
`hive-forge-oidc-secret` copied out of authelia's container tree. That
unit only existed where authelia ran on the forge's host (`ssoLocal`),
so a forge anywhere else needed the file placed by hand.

The publisher on authelia's host now carries the forge's client secret
to `secret/swarm/services/<forge client id>/oidc/client`, like every
other swarm service's. On the forge's host `swarm-bao-forge-oidc`, a copy
of `swarm-bao-matrix-oidc`, reads it under the forge publisher's leaf
(the forge host's one store identity, whose policy gains read on that
one path) and writes the file `forgejo-sso-source` reads, re-running the
login source when the value changes. It retries on the shared
store-retry shape while the store is down or the secret is not yet
published.

`hive-forge-oidc-secret` is removed, `clientSecretFile` defaults to the
in-container path wherever the forge runs, and the `ssoLocal` gate on
the login source's resolver ordering goes with it: the login source
fetches the issuer's discovery document on every forge host.

Refs #5015

nix/host-modules/otel.nix

@@ -692,9 +692,6 @@ in
       # exist. This oneshot converts the fast failure into a slow one, which
       # is what that restart policy is actually good at.
       #
-      # Copied from `hive-forge-oidc-secret.service`, which solves exactly
-      # this for the forge — see `docs/swarm/secrets.md`.
-      #
       # Not rendered beside the store fetch below, which restarts the
       # collector itself when the file lands.
       systemd.services.${secretWaitUnit} = lib.mkIf waits {