deploy: move the controller and swarm-ui toggles

One commit rather than two because they are not independent: the UI's
`enable` had the controller's as its literal default, so moving the
controller alone would leave the UI's default naming an option that no
longer exists.

The UI keeps that derivation in its new home — it is a view onto the
controller's state and reaches it over that daemon's unix socket, so the
host running the controller is the host that can serve it.

Three spellings had to move together for the UI, not one: the `default`,
the `defaultText` shown in the options doc, and the description prose
that names the old path in words. A grep for the option path finds the
first two.

The sweep also reached outside nix: `swarm-controller`'s crate README and
its `//!` module doc both named the option, as did this repo's own
CLAUDE.md and four pages under docs/. An option's name is API, and its
documentation lives wherever someone thought to write it down.

swarm-controller/src/main.rs

@@ -1,6 +1,6 @@
 //! Swarm-level controller daemon. Runs as the unprivileged
 //! `swarm-controller` user on whichever host the operator flips
-//! `services.hyperhive.swarm.controller.enable` on, and serves HTTP over a
+//! `services.hyperhive.deploy.controller` on, and serves HTTP over a
 //! unix socket that the hive-gateway's nginx proxies to.
 //!
 //! Configuration is read-only and loaded once at startup from env vars the