nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable

`services.hyperhive.enable` and `services.hyperhive.c0re.enable` are gone.
One switch, `services.hyperhive.deploy.hive-controller.enable` (default
false, as the old toggle was), now gates hive-c0re and hive-priv. Both old
paths are `mkRenamedOptionModule` shims in deploy.nix, so a host config
that still sets either evaluates as before and gets a rename warning.

Every other read of the old toggle is resolved, including the 29 made
through the `hyperhiveCfg`/`hiveCfg` aliases:

- Dropped: each swarm service and its glue keeps only its own deploy
  toggle (authelia, bao and its PKI glue, grafana, victorialogs,
  victoriametrics, the secret publisher, swarm-ca, the OIDC client rows,
  the controller/nats/matrix-ctl/publisher/services-issuer identities),
  the forge, and the `domain` deprecation warning.
- To deploy.hive-controller.enable: the queue-agent credential reader and
  its assertion, which feed hive-c0re and write under its state dir, plus
  their policy-order entry; the network identity assertions; hive-tls's
  two writes into hive-c0re's environment.
- hive-tls runs where the gateway runs self-signed
  (`gateway.enable && useSelfSigned`), not on every host.
- The matrix appservice-token reader and its assertion stay on
  `deploy.matrix.enable` plus their client-identity checks. They read
  deploy.matrix's token file and registration script; their deploy.bao
  inputs are the client-half options a hive sets to read a store it does
  not run, so gating on deploy.bao.enable would drop the tested
  remote-reader case.
- The `hiveName` assertion moves from hive-network.nix to hyperhive.nix
  and fires wherever the hive, the store or the homeserver runs: each
  turns the name into an identifier with no fallback.

On a host with `deploy.allSwarmServices` and no hive, the documented
services-host recipe, authelia, bao, grafana, victorialogs,
victoriametrics, the OIDC client rows and the hive CA now render; before,
the old toggle being off left them out.

Refs #4500

nix/module-eval/core-toggle.nix

@@ -30,17 +30,17 @@ let
 
   bare = hive { };
 
-  # The same stub with the central toggle off. Paired with `bare` below to pin
-  # the defaults that used to read `services.hyperhive.enable` and no longer
-  # do: each is asserted to hold the SAME literal in both, so a future edit
-  # that quietly re-introduces the dependency — or that changes what the
+  # The same stub with the central toggle (`deploy.hive-controller.enable`)
+  # off. Paired with `bare` below to pin the defaults that do not read it:
+  # each is asserted to hold the SAME literal in both, so a future edit
+  # that quietly introduces the dependency — or that changes what the
   # default renders for a hive with the toggle on — fails here. Reading an
   # option off this fixture forces that option only, not the config, so the
   # toggle being off costs nothing. Also the "installs the modules and turns
   # nothing on" host the swarm-service absences below read: none of the
   # per-service deployment toggles derives from the hive being on, so it
   # renders the same absences `bare` does.
-  centralToggleOff = hive { enable = false; };
+  centralToggleOff = hive { deploy.hive-controller.enable = false; };
 
   # Every hive defaults the agents' queue address to the queue's name, so the
   # only hive without one is a hive told to have none.
@@ -104,7 +104,7 @@ let
       name = "the swarm controller's forgeTokenFile default does not consult the central toggle";
       ok =
         (hive {
-          enable = false;
+          deploy.hive-controller.enable = false;
           deploy.forgejo.enable = true;
         }).services.hyperhive.deploy.swarm-controller.forgeTokenFile
         == "/var/lib/hyperhive-forge/swarm-controller.token";
@@ -453,6 +453,55 @@ let
         && bare.services.dnsmasq.enable
         && bare.networking.bridges ? hive-br0;
     }
+    {
+      # A host config written against either old spelling still runs its hive.
+      # The builder's own `true` is lowered to `mkDefault false`, so only the
+      # forwarded definition can turn it on.
+      name = "the old hive toggles forward to deploy.hive-controller.enable and warn";
+      ok =
+        let
+          renamedFrom =
+            old: m:
+            lib.any (
+              w: lib.hasInfix old w && lib.hasInfix "services.hyperhive.deploy.hive-controller.enable" w
+            ) m.warnings;
+          viaOld =
+            extra:
+            hive (
+              extra
+              // {
+                deploy.hive-controller.enable = lib.mkDefault false;
+              }
+            );
+          oldEnable = viaOld { enable = true; };
+          oldC0re = viaOld { c0re.enable = true; };
+        in
+        oldEnable.services.hyperhive.deploy.hive-controller.enable
+        && oldEnable.systemd.services ? hive-c0re
+        && renamedFrom "services.hyperhive.enable" oldEnable
+        && oldC0re.services.hyperhive.deploy.hive-controller.enable
+        && oldC0re.systemd.services ? hive-c0re
+        && renamedFrom "services.hyperhive.c0re.enable" oldC0re;
+    }
+    {
+      # Refused wherever something turns the name into an identifier, and only
+      # there. The store host is the control that the refusal is not the hive's
+      # alone; the host running neither is the control that it is gated at all.
+      name = "a missing hiveName is refused on a hive and on a store host, not elsewhere";
+      ok =
+        let
+          refusedHiveName =
+            extra:
+            lib.any (a: !a.assertion && lib.hasInfix "services.hyperhive.hiveName to be set" a.message)
+              (hive ({ hiveName = null; } // extra)).assertions;
+        in
+        refusedHiveName { }
+        && refusedHiveName {
+          deploy.hive-controller.enable = false;
+          deploy.bao.enable = true;
+        }
+        && !(refusedHiveName { deploy.hive-controller.enable = false; });
+    }
   ];
 in
 runGroup "core-toggle" cases