nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable

`services.hyperhive.enable` and `services.hyperhive.c0re.enable` are gone.
One switch, `services.hyperhive.deploy.hive-controller.enable` (default
false, as the old toggle was), now gates hive-c0re and hive-priv. Both old
paths are `mkRenamedOptionModule` shims in deploy.nix, so a host config
that still sets either evaluates as before and gets a rename warning.

Every other read of the old toggle is resolved, including the 29 made
through the `hyperhiveCfg`/`hiveCfg` aliases:

- Dropped: each swarm service and its glue keeps only its own deploy
  toggle (authelia, bao and its PKI glue, grafana, victorialogs,
  victoriametrics, the secret publisher, swarm-ca, the OIDC client rows,
  the controller/nats/matrix-ctl/publisher/services-issuer identities),
  the forge, and the `domain` deprecation warning.
- To deploy.hive-controller.enable: the queue-agent credential reader and
  its assertion, which feed hive-c0re and write under its state dir, plus
  their policy-order entry; the network identity assertions; hive-tls's
  two writes into hive-c0re's environment.
- hive-tls runs where the gateway runs self-signed
  (`gateway.enable && useSelfSigned`), not on every host.
- The matrix appservice-token reader and its assertion stay on
  `deploy.matrix.enable` plus their client-identity checks. They read
  deploy.matrix's token file and registration script; their deploy.bao
  inputs are the client-half options a hive sets to read a store it does
  not run, so gating on deploy.bao.enable would drop the tested
  remote-reader case.
- The `hiveName` assertion moves from hive-network.nix to hyperhive.nix
  and fires wherever the hive, the store or the homeserver runs: each
  turns the name into an identifier with no fallback.

On a host with `deploy.allSwarmServices` and no hive, the documented
services-host recipe, authelia, bao, grafana, victorialogs,
victoriametrics, the OIDC client rows and the hive CA now render; before,
the old toggle being off left them out.

Refs #4500

nix/host-modules/glue-queue-agent-credential.nix

@@ -20,10 +20,10 @@
 # into one that is refused, which reaches the agent as a timeout.
 #
 # 📌 This runs wherever a client identity is configured, NOT only where the
-# store is — the rule ./glue-matrix-bao-token.nix states in full. There is no
-# "this hive runs agents" condition to gate it on as well: agent containers
-# are created at runtime by hive-c0re, so every hyperhive host is a host that
-# may run one.
+# store is — the rule ./glue-matrix-bao-token.nix states in full — and
+# wherever this host runs a hive (`deploy.hive-controller.enable`): the
+# credential is for the agents hive-c0re creates here at runtime, and the unit
+# writes under hive-c0re's own state directory.
 {
   pkgs,
   lib,
@@ -74,7 +74,8 @@ let
   # one agreement.
   #
   # `hiveName` has no fallback here for the reason ./glue-bao-tls.nix gives at
-  # its own use of it: it is asserted set for every hyperhive host.
+  # its own use of it: it is asserted set wherever
+  # `deploy.hive-controller.enable` is.
   credentialPath = "secret/swarm/hives/${hyperhiveCfg.hiveName}/queue/agent";
 in
 {
@@ -110,11 +111,11 @@ in
     #
     # Shaped after ./swarm-grafana.nix's `haveClientIdentity` assertion — the
     # same refusal, named to this principal's own pair. Where Grafana's gate
-    # is `deploy.grafana.enable`, this reader has no toggle of its own to
-    # check: every hive runs one for its own agents, so reading the store at
-    # all is what asks for it. Hence `hiveReaderIdentity` alone — a host
-    # holding no hive leaf has no store to read and nothing is missing.
-    (lib.mkIf (hyperhiveCfg.enable && hiveReaderIdentity) {
+    # is `deploy.grafana.enable`, this reader's is the hive's own: every hive
+    # runs one for its own agents, so on a hive, reading the store at all is
+    # what asks for it. Hence `hiveReaderIdentity` — a host holding no hive
+    # leaf has no store to read and nothing is missing.
+    (lib.mkIf (deployCfg.hive-controller.enable && hiveReaderIdentity) {
       assertions = [
         {
           assertion = haveClientIdentity;
@@ -149,7 +150,7 @@ in
       ];
     })
 
-    (lib.mkIf (hyperhiveCfg.enable && haveClientIdentity) {
+    (lib.mkIf (deployCfg.hive-controller.enable && haveClientIdentity) {
       # Same rule as the unit's own gate: this reader exists on any host holding
       # a client identity, which is not every host that runs the store, so the
       # store's module cannot name it.