deploy: move the wireguard mesh out of the namespace hives read

`swarm.*` is what a hive needs to be a *client* of the swarm; the mesh is
none of it. A peer needs this host's `wireguardEndpoint` -- the roster entry
in swarm.nix, which stays -- and nothing about the interface this host
brings up. The module already said so: "plain host networking that a machine
which runs no hive at all still needs."

All five options move, so the namespace relocates rather than splitting.
`listenPort` is the one that reads the other way: it is what this host
*binds*, while the port a peer *dials* lives inside `wireguardEndpoint`.

Declared in swarm-wireguard.nix under the `deploy.*` path, following
swarm-victorialogs.nix; deploy.nix carries only the renames, per its own
"a single file to delete when the deprecation window closes". Deliberately
NOT added to deploy.nix's own options block: every entry there is a swarm
service this host deploys, and the mesh is host networking.

hivectl/src/wg.rs generates the config snippet an operator pastes, so it
moves too -- otherwise the tool's own output trips the deprecation warning.

module-eval gains a case that configures a host through the OLD path and
asserts the rendered wg-hive interface, because the new path evaluates
fine without the shim: dropping it reads as a clean tree.

nix/packages/default.nix

@@ -93,7 +93,7 @@ let
   # Completions come from the binary's own `completions <shell>` verb
   # (the single source of truth, so they never drift from the actual
   # verbs). The wireguard-tools wrap makes `hivectl wg` subcommands
-  # work before `swarm.wireguard.enable` is set (wg init is the very
+  # work before `deploy.wireguard.enable` is set (wg init is the very
   # first setup step). Completion generation runs before wrapProgram
   # since wrapProgram renames the real binary.
   hivectlPkg =