add a semi-spread example deploy and a check that evaluates it

docs/examples/semi-spread/swarm-central.nix

@@ -0,0 +1,23 @@
+# swarm-central: the swarm controller (and the swarm UI it serves) and the
+# secret store.
+{ config, ... }:
+let
+  mesh = import ./mesh.nix;
+  hyperhive = config.services.hyperhive;
+in
+{
+  services.hyperhive = {
+    deploy.swarm-controller.enable = true;
+    deploy.bao.enable = true;
+
+    # The store also listens on this machine's VPN address, for the services
+    # and hives on other machines.
+    deploy.bao.extraListenAddresses = [ mesh.swarm-central.address ];
+
+    # The swarm UI is public.
+    gateway.openFirewall = true;
+  };
+
+  # The store is reachable over the VPN only.
+  networking.firewall.interfaces.wg0.allowedTCPPorts = [ hyperhive.swarm.bao.port ];
+}