deploy: move the SSO provider toggle

The largest of these moves: sixteen references spelled through `let`
aliases across eight modules, plus eight more spelled as a path, plus
five documentation pages.

authelia is also the clearest case for why the two namespaces exist.
`swarm.authelia.url` is needed by *every* hive in the swarm — it says
where to send a browser to authenticate — while running the container is
the business of exactly one host. The client half and the server half
were sharing a namespace whose whole contract is "identical everywhere",
and only one of them could honour it.

`swarm.authelia.oidc.clients` stays where it is for the same reason:
several modules register a client there, gated on authelia running here,
and the registry itself is what the service *is* rather than a decision
about this machine.

One sweep note worth recording: a grep for `swarm.authelia.enable` misses
`swarmCfg.authelia.enable`, because the prefix is whatever the reading
file bound. Grepping the suffix `.authelia.enable` finds both, and found
a reference in swarm.nix that the path-shaped pattern did not.

docs/gateway.md

@@ -14,7 +14,7 @@ Single nginx in front of every hyperhive web surface. Runs on the **host**, next
 | `chat.<swarm>/_matrix/*` | `chat.<swarm>` | tuwunel (`8008`) | `matrix.gatewayHost != null` |
 | `chat.<swarm>/` | `chat.<swarm>` | fluffychat-web static | `matrix.gui.enable` |
 | `chat.<swarm>/config.json` | `chat.<swarm>` | inline JSON (FluffyChat boot config) | `matrix.gui.enable && domain != null` |
-| `auth.<swarm>/` | `auth.<swarm>` | authelia (`9091`) | `swarm.authelia.enable` |
+| `auth.<swarm>/` | `auth.<swarm>` | authelia (`9091`) | `deploy.authelia` |
 | `<swarm>/` | `<swarm>` | swarm-ui dist (static), behind an authelia subrequest | `deploy.swarm-ui` |
 
 The authelia vhost is declared only by the host that **runs** authelia, not by every hive that uses it — a client hive knows the swarm's `authelia.url` but must not answer for a name it doesn't serve. Its server name is exactly `swarm.authelia.domain`: authelia validates `authelia_url ⊂ session cookie domain` at startup, so a near-miss is a container that refuses to boot. It carries no `auth_basic` — the login page must not sit behind the login mechanism it replaces — and sets the four `X-Forwarded-{Proto,Host,Uri,For}` headers, since authelia decides by the *original* request rather than the hop it sees.
@@ -64,7 +64,7 @@ Each location carries a duplicated `auth_basic` block (separate locations don't
 - `<hive-domain>` → `127.0.0.1`
 - `forge.<swarm>` → `127.0.0.1` (when forge.behindGateway)
 - `chat.<swarm>` → `127.0.0.1` (when matrix.gatewayHost set)
-- `auth.<swarm>` → `127.0.0.1` (when swarm.authelia.enable)
+- `auth.<swarm>` → `127.0.0.1` (when deploy.authelia)
 
 `lib.unique` de-dupes if any sub-domain happens to equal another entry. Operators with real DNS leave it off.
 

docs/setup.md

@@ -44,7 +44,7 @@ echo "hunter2" | hivectl gateway create-user mara --password-stdin
 hivectl gateway list-users
 ```
 
-### 3 · Swarm SSO (only when `swarm.authelia.enable`)
+### 3 · Swarm SSO (only when `deploy.authelia`)
 
 ⚠️ **Required to finish the install, not optional.** Authelia treats an
 empty user store as a fatal startup error, so until this runs the

docs/swarm/services.md

@@ -34,7 +34,7 @@ One authelia per swarm, in a `swarm-authelia` container, at
 provider, differentiated by roles and claims rather than by mechanism —
 there is one IdP and one auth path.
 
-- **`swarm.authelia.enable`** — run the container here. Defaults from
+- **`deploy.authelia`** — run the container here. Defaults from
   `swarm.enableRequiredServices`.
 - **`swarm.authelia.url`** — where clients are sent to authenticate.
   Present on **every** hive, defaulting to this host's own instance only

docs/swarm/sso.md

@@ -14,7 +14,7 @@ separate `enable` would be a second fact free to disagree with the first.
 
 authelia binds loopback only. The **gateway** on the host running it
 publishes it as `auth.<swarm.domain>` — vhost, dnsmasq record and TLS
-name all follow `swarm.authelia.enable`, so there is nothing to turn on
+name all follow `deploy.authelia`, so there is nothing to turn on
 separately. (Details, including why a client hive must not declare that
 vhost: [`../gateway.md`](../gateway.md).)