forge: fetch the OIDC client secret from bao instead of a host-side copy

The forge's login source read its OIDC client secret from a file that
`hive-forge-oidc-secret` copied out of authelia's container tree. That
unit only existed where authelia ran on the forge's host (`ssoLocal`),
so a forge anywhere else needed the file placed by hand.

The publisher on authelia's host now carries the forge's client secret
to `secret/swarm/services/<forge client id>/oidc/client`, like every
other swarm service's. On the forge's host `swarm-bao-forge-oidc`, a copy
of `swarm-bao-matrix-oidc`, reads it under the forge publisher's leaf
(the forge host's one store identity, whose policy gains read on that
one path) and writes the file `forgejo-sso-source` reads, re-running the
login source when the value changes. It retries on the shared
store-retry shape while the store is down or the secret is not yet
published.

`hive-forge-oidc-secret` is removed, `clientSecretFile` defaults to the
in-container path wherever the forge runs, and the `ssoLocal` gate on
the login source's resolver ordering goes with it: the login source
fetches the issuer's discovery document on every forge host.

Refs #5015

nix/host-modules/swarm-bao.nix

@@ -931,9 +931,11 @@ let
     }
   ];
 
-  # The forge's host, publishing the controller's forge token. The one writer
-  # of the path, and write-only like the secret publisher: it copies a file in
-  # and never reads one back.
+  # The forge host's one store identity. `swarm-bao-forge-publisher` writes
+  # the controller's forge token under it, the one writer of that path and
+  # write-only: it copies a file in and never reads one back.
+  # `swarm-bao-forge-oidc` reads the forge's own OIDC client secret, that one
+  # leaf and no other service's.
   forgePublisherWriters = [
     {
       name = "swarm-forge-publisher";
@@ -942,7 +944,8 @@ let
         path "${credentialMountPath}/data/${controllerForgeTokenLeaf}" {
           capabilities = ["create", "update"]
         }
-      '';
+      ''
+      + readStanza "${credentialMountPath}/data/swarm/services/${hyperhiveCfg.swarm.forge.sso.clientId}/oidc/client";
     }
   ];
 
@@ -1754,9 +1757,11 @@ in
       default = "swarm-forge-publisher";
       description = ''
         Subject the store's `swarm-forge-publisher` cert-auth role accepts: the
-        identity `swarm-bao-forge-publisher`, the unit on the forge's host that
-        publishes the swarm-controller's forge token, presents. Its grant is
-        one path, `swarm/controller/swarm-controller/forge/token`, and write
+        forge host's one store identity, presented by `swarm-bao-forge-publisher`,
+        which publishes the swarm-controller's forge token, and by
+        `swarm-bao-forge-oidc`, which fetches the forge's OIDC client secret.
+        Its grant is two paths: `swarm/controller/swarm-controller/forge/token`,
+        write only, and `swarm/services/<forge client id>/oidc/client`, read
         only.
 
         ⚠️ Reserved as a hive name by ./swarm.nix, like its siblings.
@@ -2001,8 +2006,9 @@ in
       default = null;
       example = "/var/lib/swarm-bao-pki/forge-publisher.pem";
       description = ''
-        Certificate the unit that publishes the swarm-controller's forge token
-        presents to the store. Its subject must be
+        Certificate the forge's host presents to the store, both to publish the
+        swarm-controller's forge token and to fetch the forge's OIDC client
+        secret. Its subject must be
         {option}`services.hyperhive.deploy.bao.forgePublisherCommonName`.
 
         ./glue-bao-tls.nix points it at the leaf it mints on the store's host.