nix: pivot to services.hyperhive.* per mara directive (#612)

Per [mara on PR #615 comment 7349](http://localhost:3000/hyperhive/hyperhive/pulls/615#issuecomment-7349):
> follow nix conventions, services.hyperhive it is. the earlier we
> change this, the less breakage.

Renames the entire host-side option tree under `services.hyperhive.*`:

- `services.hive-c0re.*` → `services.hyperhive.c0re.*`
- `hyperhive.enable` → `services.hyperhive.enable`
- `hyperhive.domain` → `services.hyperhive.domain`
- `hyperhive.forge.*` → `services.hyperhive.forge.*`
- `hyperhive.matrix.*` → `services.hyperhive.matrix.*`

Per mara's "earlier = less breakage", the previous `services.hive-c0re.enable`
deprecation alias is dropped. Operators get a clear eval error on the
old paths pointing at the rename. Single migration moment.

Per-agent options in `nix/templates/harness-base.nix` (`hyperhive.model`,
`hyperhive.allowedRecipients`, etc.) stay at `hyperhive.*` — they're
container-level config, not services in the NixOS sense.

Verified via `nix flake check --no-build` + an end-to-end NixOS eval
exercising every renamed path.

Follow-up needed: rust source comments referencing the old NixOS
option names (`hive-c0re/src/{meta,coordinator,main,dashboard}.rs`)
should be updated in a separate pure-rust PR to keep this one
strictly nix-only.

nix/modules/hive-forge.nix

@@ -5,7 +5,7 @@
   ...
 }:
 let
-  cfg = config.hyperhive.forge;
+  cfg = config.services.hyperhive.forge;
 in
 {
   # Private Forgejo for hyperhive agents, wrapped in a nixos-container
@@ -24,7 +24,7 @@ in
   # and survives container restart / host reboot. To wipe, destroy the
   # container.
 
-  options.hyperhive.forge = {
+  options.services.hyperhive.forge = {
     enable = lib.mkOption {
       type = lib.types.bool;
       default = true;
@@ -33,7 +33,7 @@ in
         hyperhive agents. On by default: hive-c0re mirrors every
         agent's applied config repo into the forge's `agent-configs`
         org, so the forge is part of the standard install. Set
-        `hyperhive.forge.enable = false` to opt out.
+        `services.hyperhive.forge.enable = false` to opt out.
       '';
     };
 
@@ -220,19 +220,22 @@ in
               Group = "forgejo";
             };
             environment.GNUPGHOME = "/var/lib/forgejo/.gnupg";
-            path = [ pkgs.gnupg pkgs.coreutils ];
+            path = [
+              pkgs.gnupg
+              pkgs.coreutils
+            ];
             script = ''
-              mkdir -p "$GNUPGHOME"
-              chmod 700 "$GNUPGHOME"
-              gpg --batch --gen-key <<'EOF'
-%no-protection
-Key-Type: RSA
-Key-Length: 4096
-Name-Real: HyperHive Forge
-Name-Email: forgejo@hive
-Expire-Date: 0
-EOF
-              touch "$GNUPGHOME/hive-key-init.stamp"
+                            mkdir -p "$GNUPGHOME"
+                            chmod 700 "$GNUPGHOME"
+                            gpg --batch --gen-key <<'EOF'
+              %no-protection
+              Key-Type: RSA
+              Key-Length: 4096
+              Name-Real: HyperHive Forge
+              Name-Email: forgejo@hive
+              Expire-Date: 0
+              EOF
+                            touch "$GNUPGHOME/hive-key-init.stamp"
             '';
           };
         };