deploy: move the controller and swarm-ui toggles

One commit rather than two because they are not independent: the UI's
`enable` had the controller's as its literal default, so moving the
controller alone would leave the UI's default naming an option that no
longer exists.

The UI keeps that derivation in its new home — it is a view onto the
controller's state and reaches it over that daemon's unix socket, so the
host running the controller is the host that can serve it.

Three spellings had to move together for the UI, not one: the `default`,
the `defaultText` shown in the options doc, and the description prose
that names the old path in words. A grep for the option path finds the
first two.

The sweep also reached outside nix: `swarm-controller`'s crate README and
its `//!` module doc both named the option, as did this repo's own
CLAUDE.md and four pages under docs/. An option's name is API, and its
documentation lives wherever someone thought to write it down.

docs/gateway.md

@@ -15,7 +15,7 @@ Single nginx in front of every hyperhive web surface. Runs on the **host**, next
 | `chat.<swarm>/` | `chat.<swarm>` | fluffychat-web static | `matrix.gui.enable` |
 | `chat.<swarm>/config.json` | `chat.<swarm>` | inline JSON (FluffyChat boot config) | `matrix.gui.enable && domain != null` |
 | `auth.<swarm>/` | `auth.<swarm>` | authelia (`9091`) | `swarm.authelia.enable` |
-| `<swarm>/` | `<swarm>` | swarm-ui dist (static), behind an authelia subrequest | `swarm.ui.enable` |
+| `<swarm>/` | `<swarm>` | swarm-ui dist (static), behind an authelia subrequest | `deploy.swarm-ui` |
 
 The authelia vhost is declared only by the host that **runs** authelia, not by every hive that uses it — a client hive knows the swarm's `authelia.url` but must not answer for a name it doesn't serve. Its server name is exactly `swarm.authelia.domain`: authelia validates `authelia_url ⊂ session cookie domain` at startup, so a near-miss is a container that refuses to boot. It carries no `auth_basic` — the login page must not sit behind the login mechanism it replaces — and sets the four `X-Forwarded-{Proto,Host,Uri,For}` headers, since authelia decides by the *original* request rather than the hop it sees.
 

docs/persistence.md

@@ -472,7 +472,7 @@ snapshot contains and how the store authenticates a sender.
 ## `/var/lib/swarm-controller/` (swarm-controller host only)
 
 Only present on the one host running
-`services.hyperhive.swarm.controller.enable`. systemd `StateDirectory=`,
+`services.hyperhive.deploy.controller`. systemd `StateDirectory=`,
 so it survives restarts and redeploys.
 
 - `webhook-secret` — the HMAC key the swarm's forge webhooks are signed

docs/setup.md

@@ -70,7 +70,7 @@ than amend — adding the group afterwards is `swarmctl user update mara
 Detail, including what the password is and why this stays manual:
 [`swarm/sso.md`](swarm/sso.md).
 
-### 4 · Swarm UI (only when `swarm.ui.enable`, on by default with the controller)
+### 4 · Swarm UI (only when `deploy.swarm-ui`, on by default with the controller)
 
 Nothing to run — it is served on the swarm apex
 (`https://<swarm.domain>/`) as soon as the host rebuilds. Two things

docs/swarm/README.md

@@ -276,7 +276,7 @@ migrating agent keeps one unbroken incremental chain. See
 
 ## Swarm controller
 
-`services.hyperhive.swarm.controller.enable` runs the `swarm-controller`
+`services.hyperhive.deploy.controller` runs the `swarm-controller`
 daemon on this host. **Off by default and deliberately not derived from
 `services.hyperhive.enable`**: a swarm has one controller, so enabling it
 is a statement about swarm topology, not about whether hyperhive is

docs/swarm/ui.md

@@ -9,7 +9,7 @@ answers for one host. This one is the view *across* hives.
 ## Enabling
 
 ```nix
-services.hyperhive.swarm.ui.enable = true;   # defaults to swarm.controller.enable
+services.hyperhive.deploy.swarm-ui = true;   # defaults to deploy.controller
 ```
 
 Derived from the controller rather than from `enableRequiredServices`: