nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable

`services.hyperhive.enable` and `services.hyperhive.c0re.enable` are gone.
One switch, `services.hyperhive.deploy.hive-controller.enable` (default
false, as the old toggle was), now gates hive-c0re and hive-priv. Both old
paths are `mkRenamedOptionModule` shims in deploy.nix, so a host config
that still sets either evaluates as before and gets a rename warning.

Every other read of the old toggle is resolved, including the 29 made
through the `hyperhiveCfg`/`hiveCfg` aliases:

- Dropped: each swarm service and its glue keeps only its own deploy
  toggle (authelia, bao and its PKI glue, grafana, victorialogs,
  victoriametrics, the secret publisher, swarm-ca, the OIDC client rows,
  the controller/nats/matrix-ctl/publisher/services-issuer identities),
  the forge, and the `domain` deprecation warning.
- To deploy.hive-controller.enable: the queue-agent credential reader and
  its assertion, which feed hive-c0re and write under its state dir, plus
  their policy-order entry; the network identity assertions; hive-tls's
  two writes into hive-c0re's environment.
- hive-tls runs where the gateway runs self-signed
  (`gateway.enable && useSelfSigned`), not on every host.
- The matrix appservice-token reader and its assertion stay on
  `deploy.matrix.enable` plus their client-identity checks. They read
  deploy.matrix's token file and registration script; their deploy.bao
  inputs are the client-half options a hive sets to read a store it does
  not run, so gating on deploy.bao.enable would drop the tested
  remote-reader case.
- The `hiveName` assertion moves from hive-network.nix to hyperhive.nix
  and fires wherever the hive, the store or the homeserver runs: each
  turns the name into an identifier with no fallback.

On a host with `deploy.allSwarmServices` and no hive, the documented
services-host recipe, authelia, bao, grafana, victorialogs,
victoriametrics, the OIDC client rows and the hive CA now render; before,
the old toggle being off left them out.

Refs #4500

nix/host-modules/hive-network.nix

@@ -35,7 +35,7 @@ in
   imports = [
     (lib.mkRemovedOptionModule [ "services" "hyperhive" "network" "isolateContainers" ] ''
       Network isolation is the only mode and is always on whenever
-      hyperhive is enabled; the shared-netns path was removed. Remove
+      the hive runs; the shared-netns path was removed. Remove
       the setting.
     '')
     (lib.mkRemovedOptionModule [ "services" "hyperhive" "network" "upstreamDns" ] ''
@@ -148,11 +148,12 @@ in
   };
 
   config = lib.mkMerge [
-    # Identity checks belong to hyperhive being on, not to the bridge
+    # Identity checks belong to the hive being on, not to the bridge
     # being up: a hive with no domain is misconfigured either way, and
     # moving them under the bridge gate would hide them on exactly the
-    # hosts that are hardest to debug.
-    (lib.mkIf config.services.hyperhive.enable {
+    # hosts that are hardest to debug. `hiveName` is asserted in
+    # ./hyperhive.nix, where more than the hive depends on it.
+    (lib.mkIf config.services.hyperhive.deploy.hive-controller.enable {
       # This message is only useful if an operator can actually reach
       # it, and an assertion competes with every eager default that
       # reads the value it guards: option defaults that interpolate the
@@ -196,16 +197,6 @@ in
             `services.hyperhive.domain` for you.
           '';
         }
-        {
-          assertion = config.services.hyperhive.hiveName != null;
-          message = ''
-            hyperhive requires services.hyperhive.hiveName to be set —
-            it is this hive's label within the swarm, and the leftmost
-            part of the domain it is addressed by
-            (`<hiveName>.<swarm.domain>`), not only a display name.
-            Set it (`services.hyperhive.hiveName = "pr1ma";`).
-          '';
-        }
       ];
     })