feat(3089): all-local asserts the swarm controller

`enableAllLocalDefaults` already asserts the swarm's shared services and
its CA; the controller was the one swarm-level thing it left off, so the
default deployment ran authelia, matrix and the forge with nothing
controlling them — and, until the previous commit in this area, without
`swarmctl` either.

The controller's own option stays `default = false`. Running it is a
statement about swarm topology rather than about hyperhive being
installed, and no single host can infer that on its own. But "this box
is the whole deployment" IS that statement, which is why the mode may
assert what `services.hyperhive.enable` never could.

Derived from the mode, not from `enableRequiredServices`: a hive in a
larger swarm can legitimately want the shared services without being the
host that controls them.

`mkDefault`, so `enableAllLocalDefaults = true` with an explicit
`controller.enable = false` still yields a controller-less box — the
mode fills in for an operator who hasn't spoken and never argues with
one who has.

nix/host-modules/swarm-controller.nix

@@ -60,6 +60,12 @@ in
         deliberately not derived from `services.hyperhive.enable`: a swarm
         has one controller, so enabling it per hive is a decision about
         swarm topology, not about whether hyperhive is installed.
+
+        `services.hyperhive.enableAllLocalDefaults` does assert it, and
+        that is not an exception to the rule above — it is the rule
+        applied. That mode says "this box is the whole deployment", which
+        answers the topology question outright, where
+        `services.hyperhive.enable` alone never can.
       '';
     };