deploy: move the matrix homeserver toggle out of swarm

swarm.matrix.enable was the last toggle still spelled swarm.*, which
is the namespace every host in the swarm agrees on - and "does this
host run the homeserver" is exactly what differs between them. It
moves to deploy.matrix.enable with the rest; the genuinely swarm-wide
matrix settings stay where they are.

mkRenamedOptionModule keeps existing configs evaluating with one
warning naming both paths.

The sweep for readers had to be unanchored and cross-language: three
of them were outside nix, including a hive-c0re error message telling
the operator to set the old name. A dotted grep also cannot see the
rename module's own list form, so that was checked separately.

hive-c0re/src/matrix.rs

@@ -1,7 +1,7 @@
 //! Optional matrix-tuwunel wiring: shared registration token (host) +
 //! per-agent UIAA registration → `<agent-state>/matrix-token`. No-op
 //! when the `hive-matrix` container isn't running, so operators who
-//! haven't flipped `services.hyperhive.swarm.matrix.enable = true` pay
+//! haven't flipped `services.hyperhive.deploy.matrix.enable = true` pay
 //! nothing.
 //!
 //! See `docs/matrix.md::Provisioning flow (registration token)` for

hive-c0re/src/server.rs

@@ -487,7 +487,7 @@ fn require_matrix_present() -> Result<()> {
         return Ok(());
     }
     anyhow::bail!(
-        "no matrix homeserver configured — set services.hyperhive.swarm.matrix.enable = true to run one \
+        "no matrix homeserver configured — set services.hyperhive.deploy.matrix.enable = true to run one \
          here, or services.hyperhive.swarm.matrix.apiUrl to point at an existing one, before \
          provisioning matrix users"
     )