nix: move the remaining service containers onto the swarm-container module

hive-ci, hive-forge, hive-matrix, swarm-authelia, swarm-bao, swarm-grafana,
swarm-nats, swarm-otel and swarm-victorialogs now import
./swarm-container.nix and drop their own copies of the stateVersion,
firewall and resolvconf lines. Each binds privateNetwork once in its
top-level let and passes it to both the host attr and the in-container
option, as swarm-victoriametrics already does.

hive-forge (25.11) and swarm-otel (the host's value) keep their own
stateVersion over the module's mkDefault. hive-ci sets privateNetwork =
true and writesOwnResolvConf = false, which leaves its firewall and
resolvconf on, as before. hive-matrix keeps its useHostResolvConf
override and static resolv.conf; its resolvconf mkForce now comes from
the module default.

Every container's system.build.toplevel drvPath and host-side attrs
evaluate identical to the parent commit.

module-eval-swarm-services-switch gains a fixture with all ten service
containers and checks that each one's in-container privateNetwork equals
its host-side value, that the nine on the host netns run no firewall or
resolvconf, that hive-ci keeps both, and that hive-forge keeps its pinned
stateVersion.

Refs #3773

nix/host-modules/hive-forge/default.nix

@@ -102,6 +102,12 @@ let
     ++ lib.optional (
       ciEnabled && !(lib.any (m: m.dest == actionCheckoutMirror.dest) deployCfg.forgejo.mirrors)
     ) actionCheckoutMirror;
+
+  # Share host netns — forgejo's HTTP / SSH listeners then look
+  # exactly like a host-side service, no port forwarding dance,
+  # and agent containers (which also share host netns) reach it
+  # via plain `localhost`.
+  privateNetwork = false;
 in
 {
   # Private Forgejo in a `hive-forge` nixos-container, shared host
@@ -665,11 +671,7 @@ in
       # Journal files on the host, not inside the container: nixpkgs hardcodes
       # --link-journal=try-guest, and EXTRA_NSPAWN_FLAGS expands after it.
       extraFlags = [ "--link-journal=host" ];
-      # Share host netns — forgejo's HTTP / SSH listeners then look
-      # exactly like a host-side service, no port forwarding dance,
-      # and agent containers (which also share host netns) reach it
-      # via plain `localhost`.
-      privateNetwork = false;
+      inherit privateNetwork;
       # Self-signed mode: bind the public hive CA cert read-only so forgejo
       # can trust the gateway's self-signed leaf for outbound webhook
       # delivery. The bind-mount, the `container@` ordering and the bundle
@@ -701,6 +703,7 @@ in
         in
         {
           imports = [
+            ./../../container-modules/swarm-container.nix
             # Ask the hive's dnsmasq, not the host's resolvers. The swarm
             # names — the controller's webhook endpoint, the SSO issuer —
             # resolve to the bridge and have no public records, so a
@@ -742,18 +745,7 @@ in
           ];
 
           system.stateVersion = "25.11";
-
-          # Shared host netns: this container's own firewall.service
-          # would rewrite the HOST ruleset (flush nixos-fw, drop the
-          # host's nixos-nat-* chains) at every boot — killing the
-          # bridge DHCP/DNS holes and agent NAT. The host firewall owns
-          # all filtering; never run one in here.
-          networking.firewall.enable = false;
-          # resolvconf stays off because the resolver unit imported above
-          # owns /etc/resolv.conf. Leaving it on would let host-tracking
-          # regenerate the file empty, since the host's copy doesn't cross
-          # the boundary after start.
-          networking.resolvconf.enable = lib.mkForce false;
+          services.hyperhive.swarmContainer = { inherit privateNetwork; };
 
           services.forgejo = {
             enable = true;