Fix nix references in prose that no longer resolve

Nine of the 38 .nix tokens mentioned anywhere in *.rs did not name
anything that exists. Twelve mentions, five distinct targets:
hive-c0re.nix, hive-gateway.nix and hive-forge.nix are all directories
now; nix/modules/ is not a directory we have; hive-forge-tools.nix was
a bash script the binary replaced and is gone.

Where the reference is load-bearing it is corrected rather than
deleted, because the reference is the point: a comment saying a
constant must match a nix literal is only useful if you can open the
file it names. Where the module member was unambiguous the path now
names it exactly.

paths.rs's STATE_ROOT marker was the worst of them: it claimed the
value came from services.hyperhive.c0re.statePath, in hive-c0re.nix.
Neither exists. The option is not declared anywhere and the file is a
directory, so a "must match" contract pointed at two things that
cannot be opened. /var/lib/hyperhive is hardcoded on both sides, which
is what the comment now says.

hive-forge-tools.nix keeps no replacement: naming a file that was
deliberately deleted helps nobody, and "replaces a prior bash script"
is complete without it.

Measured before and after with the same command: 9 unresolved of 38
before, 4 of 35 after. The remaining four are an example path in a doc
comment, an upstream nixpkgs path, and two from one synthetic test
fixture.

hive-c0re/src/stats/hive_stats.rs

@@ -115,7 +115,7 @@ pub type PriceTable = HashMap<String, Prices>;
 /// Sonnet 4.x, Haiku 4.5); `cache_write` uses the 1-hour cache-TTL price,
 /// which is the default through the Claude subscription the agents run
 /// on. Keep in sync with the `services.hyperhive.modelPrices` nix default
-/// (`nix/modules/hive-c0re.nix`).
+/// (`nix/host-modules/hive-c0re/options.nix`).
 fn builtin_prices(model: &str) -> Prices {
     let m = model.to_ascii_lowercase();
     if m.contains("opus") {