nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable

`services.hyperhive.enable` and `services.hyperhive.c0re.enable` are gone.
One switch, `services.hyperhive.deploy.hive-controller.enable` (default
false, as the old toggle was), now gates hive-c0re and hive-priv. Both old
paths are `mkRenamedOptionModule` shims in deploy.nix, so a host config
that still sets either evaluates as before and gets a rename warning.

Every other read of the old toggle is resolved, including the 29 made
through the `hyperhiveCfg`/`hiveCfg` aliases:

- Dropped: each swarm service and its glue keeps only its own deploy
  toggle (authelia, bao and its PKI glue, grafana, victorialogs,
  victoriametrics, the secret publisher, swarm-ca, the OIDC client rows,
  the controller/nats/matrix-ctl/publisher/services-issuer identities),
  the forge, and the `domain` deprecation warning.
- To deploy.hive-controller.enable: the queue-agent credential reader and
  its assertion, which feed hive-c0re and write under its state dir, plus
  their policy-order entry; the network identity assertions; hive-tls's
  two writes into hive-c0re's environment.
- hive-tls runs where the gateway runs self-signed
  (`gateway.enable && useSelfSigned`), not on every host.
- The matrix appservice-token reader and its assertion stay on
  `deploy.matrix.enable` plus their client-identity checks. They read
  deploy.matrix's token file and registration script; their deploy.bao
  inputs are the client-half options a hive sets to read a store it does
  not run, so gating on deploy.bao.enable would drop the tested
  remote-reader case.
- The `hiveName` assertion moves from hive-network.nix to hyperhive.nix
  and fires wherever the hive, the store or the homeserver runs: each
  turns the name into an identifier with no fallback.

On a host with `deploy.allSwarmServices` and no hive, the documented
services-host recipe, authelia, bao, grafana, victorialogs,
victoriametrics, the OIDC client rows and the hive CA now render; before,
the old toggle being off left them out.

Refs #4500

nix/module-eval/swarm-services-switch.nix

@@ -23,20 +23,37 @@ let
     swarmServiceEnables
     ;
 
-  # The swarm-services toggle with the central one off, so the only thing
-  # that can enable the gateway/resolver/bridge here is that toggle's own
-  # module — every other module that asserts them is behind `enable`.
+  # A dedicated services host with hives elsewhere: the swarm-services
+  # toggle and no hive, the recipe docs/swarm/services.md gives.
   swarmServicesOnly = hive {
-    enable = false;
+    deploy.hive-controller.enable = false;
     deploy.allSwarmServices = true;
   };
 
+  # The same switch with every service it owns placed elsewhere, so the only
+  # thing that can enable the gateway/resolver/bridge here is that toggle's
+  # own module — each service module asserts them from its own `enable`.
+  swarmServicesSwitchAlone = hive {
+    deploy.hive-controller.enable = false;
+    deploy.allSwarmServices = true;
+    deploy.matrix.enable = false;
+    otel.enable = false;
+    deploy.authelia.enable = false;
+    deploy.nats.enable = false;
+    deploy.swarm-otel.enable = false;
+    deploy.victoriametrics.enable = false;
+    deploy.grafana.enable = false;
+    deploy.victorialogs.enable = false;
+    deploy.bao.enable = false;
+    deploy.forgejo.enable = false;
+  };
+
   # Ports asked for on such a host. The request is the whole condition: the
   # firewall hole exists because an operator named a port, not because the
   # hive is running, and an agent reaching a host service is a claim about
   # the host's own listeners either way.
   exposedPortsNoHive = hive {
-    enable = false;
+    deploy.hive-controller.enable = false;
     network.exposeHostPorts = [ 5432 ];
   };
 
@@ -129,9 +146,44 @@ let
       # module rather than from any of their defaults.
       name = "the swarm-services toggle turns on the gateway, resolver and bridge by itself";
       ok =
-        swarmServicesOnly.services.hyperhive.gateway.enable
-        && swarmServicesOnly.services.hyperhive.gateway.dns.enable
-        && swarmServicesOnly.services.hyperhive.network.enable;
+        swarmServicesSwitchAlone.services.hyperhive.gateway.enable
+        && swarmServicesSwitchAlone.services.hyperhive.gateway.dns.enable
+        && swarmServicesSwitchAlone.services.hyperhive.network.enable;
+    }
+    {
+      # Each service is gated on its own deployment toggle alone, so a host
+      # that runs no hive still runs every shared service the switch turns
+      # on, plus the plumbing and the self-signed CA they are served through.
+      # Nothing starts the hive's own daemons. `hive-c0re` is checked by what
+      # starts it rather than by key: ../host-modules/hive-network.nix's bridge
+      # block writes to its environment wherever the bridge is up.
+      name = "a services-only host runs the swarm's shared services and no hive";
+      ok =
+        let
+          c = swarmServicesOnly.containers;
+          s = swarmServicesOnly.systemd.services;
+          h = swarmServicesOnly.services.hyperhive;
+        in
+        lib.all (m: c ? ${m}) [
+          "swarm-authelia"
+          "swarm-bao"
+          "swarm-grafana"
+          "swarm-victorialogs"
+          "swarm-victoriametrics"
+          "swarm-otel"
+          "swarm-nats"
+          "hive-matrix"
+          "hive-forge"
+        ]
+        && h.gateway.enable
+        && h.gateway.dns.enable
+        && h.network.enable
+        && s ? hive-tls-ca
+        && s ? swarm-bao-pki
+        && (s.hive-c0re.wantedBy or [ ]) == [ ]
+        && !(swarmServicesOnly.systemd.sockets ? hive-c0re)
+        && !(swarmServicesOnly.systemd.sockets ? hive-priv)
+        && !(s ? swarm-bao-queue-agent);
     }
     {
       # An operator's explicit `false` beats every `mkDefault` assertion,