deploy: move the wireguard mesh out of the namespace hives read

`swarm.*` is what a hive needs to be a *client* of the swarm; the mesh is
none of it. A peer needs this host's `wireguardEndpoint` -- the roster entry
in swarm.nix, which stays -- and nothing about the interface this host
brings up. The module already said so: "plain host networking that a machine
which runs no hive at all still needs."

All five options move, so the namespace relocates rather than splitting.
`listenPort` is the one that reads the other way: it is what this host
*binds*, while the port a peer *dials* lives inside `wireguardEndpoint`.

Declared in swarm-wireguard.nix under the `deploy.*` path, following
swarm-victorialogs.nix; deploy.nix carries only the renames, per its own
"a single file to delete when the deprecation window closes". Deliberately
NOT added to deploy.nix's own options block: every entry there is a swarm
service this host deploys, and the mesh is host networking.

hivectl/src/wg.rs generates the config snippet an operator pastes, so it
moves too -- otherwise the tool's own output trips the deprecation warning.

module-eval gains a case that configures a host through the OLD path and
asserts the rendered wg-hive interface, because the new path evaluates
fine without the shim: dropping it reads as a clean tree.

nix/host-modules/swarm.nix

@@ -144,7 +144,7 @@ in
               example = "base64pubkey=";
               description = ''
                 WireGuard public key for this hive's host. Required when
-                `services.hyperhive.swarm.wireguard.enable = true` and
+                `services.hyperhive.deploy.wireguard.enable = true` and
                 you want this hive reachable over the mesh. Null = TLS-
                 only peering (public internet, no mesh tunnel).
               '';