swarm: move the queue's responder package to deploy

`swarm.nats.authPackage` is the callout responder's build — a host
decision like every other package in this slice — so it joins the
`deploy.nats` block that already holds `enable`, the seed paths and the
auto-mint toggle. Its one reader is the `ExecStart` in this file.

Three comments moved with it, and none of them survived the move
unedited:

- The "deliberately NO `package` option" note now says *anywhere* —
  it argued against a `package` under `swarm.nats`, and after the move
  a reader's next question is why there isn't one under `deploy.nats`
  either, where every other service's build now lives.
- The description's "see the note above" stopped resolving: the note
  is ~80 lines up and in a different option block, so it names
  `options.services.hyperhive.swarm.nats` explicitly.
- The split-rationale comment listed "the responder package" among
  what the queue IS to every hive. It's what the host running it
  decides, so it moved to that half of the sentence.

`flake.nix` writes this option (`lib.mkDefault`), so the writer is
repointed too — three of those left, all in the same block.

The eval fixture gains the old path rather than a new case: the shim
is what a dropped rename would break, and `natsOldPath` already fails
the eval if any single entry goes missing.

flake.nix

@@ -151,7 +151,7 @@
               services.hyperhive.deploy.swarm-ui.package =
                 lib.mkDefault
                   self.packages.${pkgs.stdenv.hostPlatform.system}.swarm-ui;
-              services.hyperhive.swarm.nats.authPackage =
+              services.hyperhive.deploy.nats.authPackage =
                 lib.mkDefault
                   self.packages.${pkgs.stdenv.hostPlatform.system}.swarm-nats-auth;
               services.hyperhive.swarm.authelia.bridgePackage =

nix/host-modules/deploy.nix

@@ -369,6 +369,10 @@ in
       [ "services" "hyperhive" "swarm" "ui" "package" ]
       [ "services" "hyperhive" "deploy" "swarm-ui" "package" ]
     )
+    (lib.mkRenamedOptionModule
+      [ "services" "hyperhive" "swarm" "nats" "authPackage" ]
+      [ "services" "hyperhive" "deploy" "nats" "authPackage" ]
+    )
   ];
 
   # ⚠️ `deploy.forgejo` is declared in ./hive-ci.nix, not here, and it is the

nix/host-modules/swarm-nats.nix

@@ -217,12 +217,14 @@ in
     # ./deploy.nix. What stays here is what the queue IS: its domain,
     # ports, accounts and callout wiring.
 
-    # ⚠️ Deliberately NO `package` option, unlike this module's siblings.
+    # ⚠️ Deliberately NO `package` option for the NATS server, anywhere —
-    # `services.nats` upstream does not expose one — it resolves
+    # not here and not under `deploy.nats` either, where every other
-    # `pkgs.nats-server` itself — so an option here would either be
+    # service's build now lives. `services.nats` upstream does not expose
-    # ignored or need an overlay to mean anything, and an option that
+    # one; it resolves `pkgs.nats-server` itself, so an option would be
-    # does not control what it names is worse than its absence. Pin the
+    # ignored or need an overlay to mean anything, and an option that does
-    # build with `nixpkgs.overlays` if you need to.
+    # not control what it names is worse than its absence. Pin the build
+    # with `nixpkgs.overlays` if you need to. (`deploy.nats.authPackage`
+    # is a different thing: the callout responder, which IS ours.)
 
     port = lib.mkOption {
       type = lib.types.port;
@@ -284,6 +286,19 @@ in
       '';
     };
 
+  };
+
+  # What stays above is what the queue IS to every hive: the ports it answers
+  # on and the client id it is registered under. What the host running it
+  # decides is below — which responder build it runs, whether it mints its own
+  # keypairs, and where the seeds sit. `enable` already lives in ./deploy.nix,
+  # which also carries the renames.
+  #
+  # ⚠️ The two PUBLIC keys move with their seeds rather than staying: peers
+  # receive the user key over the wire when they connect (docs/swarm/secrets.md),
+  # they never configure it, and splitting a keypair across two namespaces is
+  # worse than either placement.
+  options.services.hyperhive.deploy.nats = {
     authPackage = lib.mkOption {
       type = lib.types.package;
       defaultText = lib.literalExpression "hyperhive.packages.\${system}.swarm-nats-auth";
@@ -291,25 +306,15 @@ in
         The auth-callout responder package.
 
         ⚠️ Named `authPackage`, not `package`, on purpose: this module
-        deliberately has **no** `package` option for the server itself
+        deliberately has **no** `package` option for the NATS server
-        (see the note above — upstream's `services.nats` resolves
+        itself, because upstream's `services.nats` resolves
-        `pkgs.nats-server` on its own), so a bare `package` here would
+        `pkgs.nats-server` on its own — see the note above
-        read as "the NATS package" and mean something else entirely.
+        `options.services.hyperhive.swarm.nats`. A bare `package` here
+        would read as "the NATS package" and mean something else
+        entirely.
       '';
     };
-  };
 
-  # What stays above is what the queue IS to every hive: the ports it answers
-  # on, the client id it is registered under, the responder package. The
-  # callout identity below is what the host running it decides — whether it
-  # mints its own keypairs, and where the seeds sit. `enable` already lives in
-  # ./deploy.nix, which also carries the renames.
-  #
-  # ⚠️ The two PUBLIC keys move with their seeds rather than staying: peers
-  # receive the user key over the wire when they connect (docs/swarm/secrets.md),
-  # they never configure it, and splitting a keypair across two namespaces is
-  # worse than either placement.
-  options.services.hyperhive.deploy.nats = {
     autoGenerateCallout = lib.mkOption {
       type = lib.types.bool;
       default = false;
@@ -708,7 +713,7 @@ in
             wantedBy = [ "multi-user.target" ];
             serviceConfig = {
               ExecStart = lib.concatStringsSep " " [
-                "${cfg.authPackage}/bin/swarm-nats-auth"
+                "${deployCfg.nats.authPackage}/bin/swarm-nats-auth"
                 "--nats-url nats://127.0.0.1:${toString cfg.port}"
                 "--user-seed-file \${CREDENTIALS_DIRECTORY}/callout-user.seed"
                 "--issuer-seed-file \${CREDENTIALS_DIRECTORY}/issuer.seed"

nix/module-eval.nix

@@ -110,7 +110,7 @@ let
   # The queue's callout identity, fourth split slice. `autoGenerateCallout` is
   # left FALSE on purpose: that is what makes the seed paths the thing deciding
   # `responderConfigured`, so the assertion below is about the seeds rather
-  # than about the auto-mint branch. All five old paths are defined, so
+  # than about the auto-mint branch. All six old paths are defined, so
   # dropping any single shim entry fails the eval, not just the arms read.
   natsOldPath = hive {
     deploy.nats.enable = true;
@@ -119,6 +119,7 @@ let
     swarm.nats.calloutIssuerPublicKey = "ATESTISSUERPUBKEYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
     swarm.nats.calloutUserSeedFile = "/run/secrets/nats-user.seed";
     swarm.nats.calloutIssuerSeedFile = "/run/secrets/nats-issuer.seed";
+    swarm.nats.authPackage = pkgs.emptyDirectory;
   };
 
   # Seventh split slice. Only `usersFile` has a rename entry: the other two