nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable

`services.hyperhive.enable` and `services.hyperhive.c0re.enable` are gone.
One switch, `services.hyperhive.deploy.hive-controller.enable` (default
false, as the old toggle was), now gates hive-c0re and hive-priv. Both old
paths are `mkRenamedOptionModule` shims in deploy.nix, so a host config
that still sets either evaluates as before and gets a rename warning.

Every other read of the old toggle is resolved, including the 29 made
through the `hyperhiveCfg`/`hiveCfg` aliases:

- Dropped: each swarm service and its glue keeps only its own deploy
  toggle (authelia, bao and its PKI glue, grafana, victorialogs,
  victoriametrics, the secret publisher, swarm-ca, the OIDC client rows,
  the controller/nats/matrix-ctl/publisher/services-issuer identities),
  the forge, and the `domain` deprecation warning.
- To deploy.hive-controller.enable: the queue-agent credential reader and
  its assertion, which feed hive-c0re and write under its state dir, plus
  their policy-order entry; the network identity assertions; hive-tls's
  two writes into hive-c0re's environment.
- hive-tls runs where the gateway runs self-signed
  (`gateway.enable && useSelfSigned`), not on every host.
- The matrix appservice-token reader and its assertion stay on
  `deploy.matrix.enable` plus their client-identity checks. They read
  deploy.matrix's token file and registration script; their deploy.bao
  inputs are the client-half options a hive sets to read a store it does
  not run, so gating on deploy.bao.enable would drop the tested
  remote-reader case.
- The `hiveName` assertion moves from hive-network.nix to hyperhive.nix
  and fires wherever the hive, the store or the homeserver runs: each
  turns the name into an identifier with no fallback.

On a host with `deploy.allSwarmServices` and no hive, the documented
services-host recipe, authelia, bao, grafana, victorialogs,
victoriametrics, the OIDC client rows and the hive CA now render; before,
the old toggle being off left them out.

Refs #4500

nix/host-modules/deploy.nix

@@ -119,6 +119,15 @@ in
       [ "services" "hyperhive" "swarm" "statusPublish" "clientSecretFile" ]
       [ "services" "hyperhive" "deploy" "hive-controller" "statusPublish" "clientSecretFile" ]
     )
+    # Both old spellings of "run a hive here" forward to the one switch.
+    (lib.mkRenamedOptionModule
+      [ "services" "hyperhive" "enable" ]
+      [ "services" "hyperhive" "deploy" "hive-controller" "enable" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "hyperhive" "c0re" "enable" ]
+      [ "services" "hyperhive" "deploy" "hive-controller" "enable" ]
+    )
     (lib.mkRenamedOptionModule
       [ "services" "hyperhive" "swarm" "otel" "enable" ]
       [ "services" "hyperhive" "deploy" "swarm-otel" "enable" ]
@@ -452,9 +461,9 @@ in
         Run the swarm's metrics UI on this host.
 
         Off by default and not derived from
-        {option}`services.hyperhive.enable`: a swarm has one Grafana, so
-        running it is a decision about this host rather than about
-        whether hyperhive is installed.
+        {option}`services.hyperhive.deploy.hive-controller.enable`: a swarm
+        has one Grafana, so running it is a decision about this host rather
+        than about whether it runs a hive.
       '';
     };
 
@@ -570,6 +579,21 @@ in
       '';
     };
 
+    hive-controller.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = ''
+        Run a hive on this host: the `hive-c0re` coordinator that owns every
+        agent container here, its `hive-priv` helper, and the bridge,
+        resolver and gateway the agents hang off.
+
+        Every hive turns this on. A host that only runs the swarm's shared
+        services ({option}`services.hyperhive.deploy.allSwarmServices`)
+        leaves it off.
+      '';
+    };
+
     swarm-controller.enable = lib.mkOption {
       type = lib.types.bool;
       default = false;
@@ -577,9 +601,9 @@ in
         Run the swarm-controller daemon on this host.
 
         Off by default and deliberately not derived from
-        {option}`services.hyperhive.enable`: a swarm has one controller,
-        so running it is a decision about this host rather than about
-        whether hyperhive is installed.
+        {option}`services.hyperhive.deploy.hive-controller.enable`: a swarm
+        has one controller, so running it is a decision about this host
+        rather than about whether it runs a hive.
       '';
     };