swarm: move the queue's responder package to deploy

`swarm.nats.authPackage` is the callout responder's build — a host
decision like every other package in this slice — so it joins the
`deploy.nats` block that already holds `enable`, the seed paths and the
auto-mint toggle. Its one reader is the `ExecStart` in this file.

Three comments moved with it, and none of them survived the move
unedited:

- The "deliberately NO `package` option" note now says *anywhere* —
  it argued against a `package` under `swarm.nats`, and after the move
  a reader's next question is why there isn't one under `deploy.nats`
  either, where every other service's build now lives.
- The description's "see the note above" stopped resolving: the note
  is ~80 lines up and in a different option block, so it names
  `options.services.hyperhive.swarm.nats` explicitly.
- The split-rationale comment listed "the responder package" among
  what the queue IS to every hive. It's what the host running it
  decides, so it moved to that half of the sentence.

`flake.nix` writes this option (`lib.mkDefault`), so the writer is
repointed too — three of those left, all in the same block.

The eval fixture gains the old path rather than a new case: the shim
is what a dropped rename would break, and `natsOldPath` already fails
the eval if any single entry goes missing.

flake.nix

@@ -151,7 +151,7 @@
               services.hyperhive.deploy.swarm-ui.package =
                 lib.mkDefault
                   self.packages.${pkgs.stdenv.hostPlatform.system}.swarm-ui;
-              services.hyperhive.swarm.nats.authPackage =
+              services.hyperhive.deploy.nats.authPackage =
                 lib.mkDefault
                   self.packages.${pkgs.stdenv.hostPlatform.system}.swarm-nats-auth;
               services.hyperhive.swarm.authelia.bridgePackage =