nix: move the egress firewall options under deploy.hive-controller.egress

docs/4-implementation/networking/network.md

@@ -522,7 +522,7 @@ the `intercept` chain, at `prerouting`, redirects IPv4 TCP port 80 to
 `<bridgeIp>:3131`, the ClientHello relay (see _ECH_ below), which sends the
 connection on to squid's other intercept listener, `<bridgeIp>:3130`. Squid reads
 the original destination from conntrack. The chain exists where the host runs
-squid (`services.hyperhive.network.egress.intercept.enable`).
+squid (`services.hyperhive.deploy.hive-controller.egress.intercept.enable`).
 
 - **Who gets redirected.** Every flow from the bridge to port 80 or 443, except
   a flow to an address that stays on the bridge, to one of the host's own
@@ -725,7 +725,7 @@ loopback — the hive-c0re admin socket is a UDS, not TCP.
 
 ### Agent bridge egress log
 
-`services.hyperhive.network.egress.forward` sets what the `forward` chain of
+`services.hyperhive.deploy.hive-controller.egress.forward` sets what the `forward` chain of
 the `inet hive_egress` table does with traffic the host routes from the agent
 bridge to anywhere but the bridge and the `wg-hive` mesh interface. It takes
 `accept`, `log` (the default) or `reject`. In `log` mode the chain blocks
@@ -751,7 +751,7 @@ also refuses the flow.
   `hive-egress-would-drop` lines. Each is a flow that `reject` would refuse; a
   flow that belongs to a legitimate use needs a fix first (a service container
   missing from `direct_mac`, an agent that should be `unrestricted`). Then set
-  `services.hyperhive.network.egress.forward = "reject"`. Making it the default
+  `services.hyperhive.deploy.hive-controller.egress.forward = "reject"`. Making it the default
   is a one-line change of the option's default.
 - **What `reject` can break.**
   - A service container with no pin yet isn't in `direct_mac`, so the
@@ -801,7 +801,7 @@ also refuses the flow.
 
 Every container on the agent bridge is root in its own network namespace and
 shares one L2 segment with the others, so it can send with another container's
-MAC or address. `services.hyperhive.network.egress.antiSpoof` sets what the
+MAC or address. `services.hyperhive.deploy.hive-controller.egress.antiSpoof` sets what the
 `bridge hive_egress` table (`nix/host-modules/hive-egress.nix`) does about it. It
 takes `drop` (the default) or `log`. Two tables, not one: the bridge carries traffic between two
 ports, and the `inet` hooks never see it as coming from a port. Only a