feat(3089): all-local asserts the swarm controller

`enableAllLocalDefaults` already asserts the swarm's shared services and
its CA; the controller was the one swarm-level thing it left off, so the
default deployment ran authelia, matrix and the forge with nothing
controlling them — and, until the previous commit in this area, without
`swarmctl` either.

The controller's own option stays `default = false`. Running it is a
statement about swarm topology rather than about hyperhive being
installed, and no single host can infer that on its own. But "this box
is the whole deployment" IS that statement, which is why the mode may
assert what `services.hyperhive.enable` never could.

Derived from the mode, not from `enableRequiredServices`: a hive in a
larger swarm can legitimately want the shared services without being the
host that controls them.

`mkDefault`, so `enableAllLocalDefaults = true` with an explicit
`controller.enable = false` still yields a controller-less box — the
mode fills in for an operator who hasn't spoken and never argues with
one who has.

nix/host-modules/local-defaults.nix

@@ -31,8 +31,9 @@ in
       Run the whole swarm on this host. Turning this on asserts the
       swarm-level toggles that an all-on-one-box deployment implies:
       the swarm's shared services
-      (`services.hyperhive.swarm.enableRequiredServices`) and the swarm
-      CA (`services.hyperhive.swarm.ca.autoConfigure`).
+      (`services.hyperhive.swarm.enableRequiredServices`), the swarm
+      CA (`services.hyperhive.swarm.ca.autoConfigure`), and the swarm
+      controller (`services.hyperhive.swarm.controller.enable`).
 
       **Off by default, and that is the load-bearing part.** A swarm's
       services and its hives can live on different hosts, and a host has
@@ -54,5 +55,13 @@ in
   config.services.hyperhive.swarm = {
     enableRequiredServices = lib.mkDefault cfg.enableAllLocalDefaults;
     ca.autoConfigure = lib.mkDefault cfg.enableAllLocalDefaults;
+    # The controller is asserted by the MODE and by nothing else. Its own
+    # option stays `default = false` precisely because running it is a
+    # statement about swarm topology — but "this box is the whole
+    # deployment" IS that statement, and it is the one shape where the
+    # answer isn't ambiguous. Deriving it from `enableRequiredServices`
+    # instead would be wrong: a hive in a larger swarm can legitimately
+    # want the shared services without being the host that controls them.
+    controller.enable = lib.mkDefault cfg.enableAllLocalDefaults;
   };
 }

nix/host-modules/swarm-controller.nix

@@ -60,6 +60,12 @@ in
         deliberately not derived from `services.hyperhive.enable`: a swarm
         has one controller, so enabling it per hive is a decision about
         swarm topology, not about whether hyperhive is installed.
+
+        `services.hyperhive.enableAllLocalDefaults` does assert it, and
+        that is not an exception to the rule above — it is the rule
+        applied. That mode says "this box is the whole deployment", which
+        answers the topology question outright, where
+        `services.hyperhive.enable` alone never can.
       '';
     };