deploy: move the metrics and log store toggles

Same move as grafana, and the three belong together: they derive from one
switch and a store with no UI is as useless as a UI with no store.

`victorialogs` is the case that shows why the option-path sweep is not
enough on its own. It has **zero** references spelled
`swarm.victorialogs.enable` anywhere in the tree, and four spelled
through `let` aliases (`vlCfg.enable` in the collector, `cfg.enable` in
its own module). A sweep for the path would have reported nothing to do
and left every reader broken.

Prose moved with the code rather than being left behind: the comments in
swarm-required-services.nix that explained why the pair derives together
now sit above the assignments that do it, instead of above the gap where
they used to be.

nix/host-modules/swarm.nix

@@ -59,7 +59,7 @@ let
   # them; the collector's exporter — same defect, no human in the loop —
   # failed every POST and dropped the samples.
   ++ lib.optional deployCfg.grafana swarmCfg.grafana.domain
-  ++ lib.optional swarmCfg.victoriametrics.enable swarmCfg.victoriametrics.domain
+  ++ lib.optional deployCfg.victoriametrics swarmCfg.victoriametrics.domain
   ++ lib.optional swarmCfg.otel.enable swarmCfg.otel.domain
   # VictoriaLogs' vhost is new (was previously unpublished entirely — see
   # swarm-victorialogs.nix's file-top comment) and needs the same
@@ -67,7 +67,7 @@ let
   # this list, `gateway.lib.tlsFor` falls back to the hive leaf, which
   # cannot cover a name under a different apex — see the ⚠️ above this
   # list for what that looked like the last time a name was missed here.
-  ++ lib.optional swarmCfg.victorialogs.enable swarmCfg.victorialogs.domain;
+  ++ lib.optional deployCfg.victorialogs swarmCfg.victorialogs.domain;
 
   # Hives whose entry still carries the removed `certFingerprint`. Scanned
   # here, at top level, because that is the only place an assertion about a