local-defaults: assert the controller through deploy, not the old alias

Round-3 review catch: the all-local mode still set
`services.hyperhive.swarm.controller.enable` -- the exact path this
branch's own `mkRenamedOptionModule` deprecates. It forwards correctly,
so nothing broke, but every eval with `enableAllLocalDefaults = true`
printed a deprecation warning and the tree depended on the shim it is
retiring.

It survived the rewrite because the path is SPLIT ACROSS NESTING:
`swarm = { controller.enable = ...; }`. No grep for a dotted path can
match text that is not contiguous -- not the prefix-anchored pattern the
rewrite used, and not the suffix-anchored one added after that missed
hive-tls.nix. What finds it is the bare tail with no prefix at all
(`^\s*controller\.enable\s*=`), which reports exactly one hit outside
deploy.nix's declarations.

The assignment moves out of the `swarm` attrset rather than staying in
it: `deploy.*` is a different top-level path, so the collision the
neighbouring warning describes -- two definitions of `swarm`, the nested
one silently lost -- does not apply.

nix/host-modules/local-defaults.nix

@@ -80,15 +80,6 @@ in
     # reach whoever runs the responder, and minting them here would move
     # that hand-off somewhere less visible rather than removing it.
     nats.autoGenerateCallout = lib.mkDefault cfg.enableAllLocalDefaults;
-    # The controller is asserted by the MODE and by nothing else. Its own
-    # option stays `default = false` precisely because running it is a
-    # statement about swarm topology — but "this box is the whole
-    # deployment" IS that statement, and it is the one shape where the
-    # answer isn't ambiguous. Deriving it from `enableRequiredServices`
-    # instead would be wrong: a hive in a larger swarm can legitimately
-    # want the shared services without being the host that controls them.
-    controller.enable = lib.mkDefault cfg.enableAllLocalDefaults;
-
     # The controller's queue coordinates. Co-location is what makes these
     # derivable at all — loopback only reaches the queue when the queue is
     # here, and the minted client secret only exists on the host authelia
@@ -117,4 +108,19 @@ in
       lib.mkDefault "${config.services.hyperhive.swarm.authelia.hostClientSecretDir}/swarm-controller.secret"
     );
   };
+
+  # The controller is asserted by the MODE and by nothing else. Its own
+  # option stays `default = false` precisely because running it is a
+  # statement about swarm topology — but "this box is the whole
+  # deployment" IS that statement, and it is the one shape where the
+  # answer isn't ambiguous. Deriving it from `enableRequiredServices`
+  # instead would be wrong: a hive in a larger swarm can legitimately
+  # want the shared services without being the host that controls them.
+  #
+  # Sits outside the `swarm` attrset above because it is a `deploy.*`
+  # option (./deploy.nix): "does THIS host run the controller" is exactly
+  # the per-host fact `swarm.*` may not carry. The ⚠️ collision note above
+  # does not apply here — that one is about two definitions of `swarm`
+  # itself, and this is a different top-level path.
+  config.services.hyperhive.deploy.swarm-controller.enable = lib.mkDefault cfg.enableAllLocalDefaults;
 }