swarm: give agent containers their own queue principal

Agents have authelia *users*; they had no machine identity at all, so an
agent could not authenticate to the swarm queue as anything. This mints
one `agent-<hive>` OIDC client per hive beside the existing
`hive-<hive>` one, teaches the auth-callout responder an agent arm, and
opens the queue's client port on the bridge so a container can reach it.

One client per HIVE, not per agent: agents are created at runtime, and a
per-agent client would make creating one a config change plus an
authelia reload. The cost is that agents on a hive are indistinguishable
to the broker, which is deliberate and tracked separately.

The agent grant is deny-by-default twice over. An agent id matches no
hive rule, so it gets a hive's status-key grant from neither; and with
no agent subject configured the responder returns no grant at all rather
than an empty publish list, which would be a denial wearing a grant's
shape. What an agent may publish is a deployment's decision, taken
through `--agent-publish-subject` the same way `--hive-publish-subject`
already works.

`Policy::new` now refuses two prefixes where one contains the other. The
arms are tried in order, so that overlap does not error at match time -
it silently hands one principal the other's grant.

Not shipped here, and neither is reachable without it: no subject is
configured for agents anywhere in nix, and nothing yet delivers
`agent-<hive>.secret` into an agent container. Both belong to the stream
that will be the first consumer.

nix/host-modules/swarm-nats.nix

@@ -233,6 +233,17 @@ in
         TCP port the queue listens on. 4222 is upstream's default and
         sits outside hyperhive's claimed ranges (dashboard 7000, forge
         3000, matrix 8008, every agent in 8100..8999 via FNV-1a hash).
+
+        Contributed to
+        `services.hyperhive.network.exposeHostPorts`, which opens it on
+        the bridge interface only — so it is reachable from agent
+        containers and not from the outside world. An agent connects to
+        `nats://<bridgeIp>:<port>`; loopback inside a container is the
+        agent itself, not this host.
+
+        Unlike {option}`monitorPort` and {option}`metricsPort`, the
+        address is not what bounds who may use this port: the queue's
+        `auth_callout` refuses every client it cannot identify.
       '';
     };
 
@@ -564,6 +575,26 @@ in
           nats = "127.0.0.1:${toString cfg.metricsPort}";
         };
 
+    # Open the client port on the bridge, so agent containers can reach
+    # the queue. `privateNetwork = false` below means the server binds in
+    # the host netns, which is the precondition this option names — but
+    # sharing a netns is not reachability: the bridge interface is
+    # default-deny, so without this an agent's connect attempt is dropped
+    # by the firewall and looks exactly like every other NATS failure,
+    # a timeout.
+    #
+    # ⚠️ Bridge interface only — never the world. What makes it safe to
+    # open at all is that the queue is fail-closed: `auth_callout` admits
+    # nobody until the responder above answers for them, so an agent that
+    # reaches this port still has to present a token authelia vouches for.
+    #
+    # An agent connects to `nats://<bridgeIp>:<port>`, NOT to
+    # `nats://127.0.0.1:<port>` — inside a container loopback is the
+    # *agent*. Every url in this repo today is the loopback one and each
+    # is correct for its reader, because those readers share the host
+    # netns; an agent does not.
+    services.hyperhive.network.exposeHostPorts = [ cfg.port ];
+
     containers.swarm-nats = {
       autoStart = true;
       ephemeral = false;
@@ -730,14 +761,15 @@ in
                 # be the same string — which is why both come from one let.
                 "--account ${lib.escapeShellArg clientAccount}"
                 "--introspection-url ${lib.escapeShellArg introspectionUrl}"
-                # Both of these name a principal some OTHER module mints,
-                # so both are read out of that module rather than spelled
+                # Each of these names a principal some OTHER module mints,
+                # so each is read out of that module rather than spelled
                 # again here — same argument as `--account` above, one
                 # level wider. The responder denies a client id it does
                 # not recognise, and a NATS denial arrives as a timeout,
                 # so a drift here is silent at the point of change and
                 # misattributed at the point of failure.
                 "--hive-client-prefix ${lib.escapeShellArg autheliaCfg.hiveClientPrefix}"
+                "--agent-client-prefix ${lib.escapeShellArg autheliaCfg.agentClientPrefix}"
                 "--reader-client ${lib.escapeShellArg controllerCfg.queueClientId}"
               ];
               # Every credential arrives by `LoadCredential` and is named