refactor(3202): the swarm UI declares its own vhost and dns name

Last of the four. The vhost, its `auth_request` block and the swarm
apex's dns record move into swarm-ui.nix; vhosts.nix drops `uiCfg`,
`controllerCfg` and `autheliaCfg` and is now 259 lines of hive surface
with no swarm service in it.

Also collapses a THIRD copy of the per-service list. `networking.hosts`
restated every service's name with its own copy of that service's guard,
after the vhosts and the dnsmasq records had each done the same. It asks
the same question — which names does this host answer for — so it now
reads the same answer: a service added later lands in /etc/hosts with no
edit, and cannot land there under a different condition than it used for
DNS.

The `forceSSL`-not-`addSSL` comment travels intact: it records that
authelia answers an http auth subrequest with 400 and nginx's
auth_request only understands 2xx/401/403, so the scheme is load-bearing
for this vhost and no other.

nix/host-modules/hive-gateway/dnsmasq.nix

@@ -9,7 +9,6 @@
   lib,
   cfg, # services.hyperhive.gateway
   networkCfg,
-  uiCfg,
   hyperhiveDomain,
 }:
 {
@@ -56,15 +55,6 @@
     address = [
       "/${hyperhiveDomain}/${networkCfg.bridgeIp}"
     ]
-    # The swarm UI's name is the swarm APEX by default — a sibling of
-    # the three above, not a child of anything this resolver already
-    # answers for, so the `/<hive domain>/` rule does not cover it.
-    #
-    # Published to agents deliberately (mara: publishing it is fine).
-    # Reachability is not the access control here: the vhost's
-    # `auth_request` + authelia's `group:operators` rule are, and an
-    # agent that resolves the name still cannot open the page.
-    ++ lib.optional uiCfg.enable "/${uiCfg.domain}/${networkCfg.bridgeIp}"
     # Names contributed by the modules that own them
     # (`gateway.localNames`). Same address as everything above — the
     # bridge IP is the gateway's answer for anything it fronts, and a