docs: nest config examples and use neutral swarm/hive names

Closes #6146

docs/4-implementation/networking/gateway.md

@@ -153,9 +153,13 @@ Only the swarm's forge host runs it (`services.hyperhive.deploy.forgejo.enable`,
 ```nix
 # The SSH port is swarm-wide: every hive dials it. The HTTP port and whether
 # THIS host opens them in its firewall are this host's deployment decisions.
-services.hyperhive.swarm.forge.sshPort = 2222; # default — git-over-SSH, off the host's openssh on 22
-services.hyperhive.deploy.forgejo.httpPort = 3000; # default — outside hyperhive's 7000 / 8100-8999
-services.hyperhive.deploy.forgejo.openFirewall = false; # default
+services.hyperhive = {
+  swarm.forge.sshPort = 2222; # default — git-over-SSH, off the host's openssh on 22
+  deploy.forgejo = {
+    httpPort = 3000; # default — outside hyperhive's 7000 / 8100-8999
+    openFirewall = false; # default
+  };
+};
 ```
 
 `sshPort` serves `git clone/push/pull` over SSH (`git@<domain>:owner/repo.git` with `-p 2222`). SSH goes straight to Forgejo, not through nginx.

docs/4-implementation/networking/network.md

@@ -92,10 +92,14 @@ listener sits on `bridgeIp`, on the host's bridge interface.
 ```nix
 {
   services.hyperhive = {
-    deploy.hive-controller.enable = true;
-    deploy.hive-controller.hiveName = "pr1ma";
-    swarm.domain = "darkest.space";
-    swarm.hives.pr1ma = { };          # -> domain = pr1ma.darkest.space
+    swarm = {
+      domain = "myswarm.example";
+      hives.firsthive = { }; # -> domain = firsthive.myswarm.example
+    };
+    deploy.hive-controller = {
+      enable = true;
+      hiveName = "firsthive";
+    };
     # network.bridgeIp = "10.42.0.1"; # default
   };
 }

docs/4-implementation/networking/snapshot-store.md

@@ -19,17 +19,19 @@ assumptions:
 ## Enabling it
 
 ```nix
-services.hyperhive.snapshotStore = {
-  enable = true;
-  path = "/var/lib/hyperhive-snapshots";  # must be on btrfs
-  port = 51821;
-};
+services.hyperhive = {
+  snapshotStore = {
+    enable = true;
+    path = "/var/lib/hyperhive-snapshots"; # must be on btrfs
+    port = 51821;
+  };
 
-# The mesh is a hard requirement, and is asserted:
-services.hyperhive.deploy.wireguard = {
-  enable = true;
-  address = "10.100.0.9/24";
-  privateKeyFile = "/etc/wireguard/hive.key";
+  # The mesh is a hard requirement, and is asserted:
+  deploy.wireguard = {
+    enable = true;
+    address = "10.100.0.9/24";
+    privateKeyFile = "/etc/wireguard/hive.key";
+  };
 };
 ```
 

docs/4-implementation/turn-loop/config.md

@@ -135,8 +135,10 @@ single-host deploy, but are useful for multi-hive or custom-network
 setups.
 
 ```nix
-services.hyperhive.agent.forge.url = "http://forge.example:3000";  # default: null
-services.hyperhive.agent.matrix.url = "https://matrix.example";    # default: null
+services.hyperhive.agent = {
+  forge.url = "http://forge.example:3000"; # default: null
+  matrix.url = "https://matrix.example"; # default: null
+};
 ```
 
 **`services.hyperhive.agent.forge.url`** — base URL of the Forgejo instance. It scopes
@@ -179,15 +181,19 @@ The harness installs Claude Code plugins before the serve loop opens.
 Three per-agent `agent.nix` options control this:
 
 ```nix
-services.hyperhive.agent.claudeMarketplaces = [                        # default
-  "anthropics/claude-plugins-official"
-  "${services.hyperhive.agent.packages.claude-plugins}"                # hive's own local marketplace, registered as `hyperhive`
-];
-services.hyperhive.agent.claudePlugins = [                              # default
-  "skill-creator@claude-plugins-official"
-  "base@hyperhive"
-];
-services.hyperhive.agent.claudePluginsAutoUpdate = false;               # default
+services.hyperhive.agent = {
+  claudeMarketplaces = [
+    # default
+    "anthropics/claude-plugins-official"
+    "${services.hyperhive.agent.packages.claude-plugins}" # hive's own local marketplace, registered as `hyperhive`
+  ];
+  claudePlugins = [
+    # default
+    "skill-creator@claude-plugins-official"
+    "base@hyperhive"
+  ];
+  claudePluginsAutoUpdate = false; # default
+};
 ```
 
 - **`claudeMarketplaces`** — list of marketplace sources passed to
@@ -248,10 +254,11 @@ programmatically and don't pass `--message-format json` themselves.
 ## API-key provider (`useApiKey` / `backendEnvironmentFile`)
 
 ```nix
-services.hyperhive.agent.useApiKey = true;               # default: false
-services.hyperhive.agent.backendEnvironmentFile =
-  "/agents/myagent/harness/openrouter.env"; # default: null
-services.hyperhive.agent.model = "anthropic/claude-3.5-sonnet"; # provider-specific model string
+services.hyperhive.agent = {
+  useApiKey = true; # default: false
+  backendEnvironmentFile = "/agents/myagent/harness/openrouter.env"; # default: null
+  model = "anthropic/claude-3.5-sonnet"; # provider-specific model string
+};
 ```
 
 Runs this agent's `claude` against an API-key provider (for example OpenRouter)