nix: pivot to services.hyperhive.* per mara directive (#612)

Per [mara on PR #615 comment 7349](http://localhost:3000/hyperhive/hyperhive/pulls/615#issuecomment-7349):
> follow nix conventions, services.hyperhive it is. the earlier we
> change this, the less breakage.

Renames the entire host-side option tree under `services.hyperhive.*`:

- `services.hive-c0re.*` → `services.hyperhive.c0re.*`
- `hyperhive.enable` → `services.hyperhive.enable`
- `hyperhive.domain` → `services.hyperhive.domain`
- `hyperhive.forge.*` → `services.hyperhive.forge.*`
- `hyperhive.matrix.*` → `services.hyperhive.matrix.*`

Per mara's "earlier = less breakage", the previous `services.hive-c0re.enable`
deprecation alias is dropped. Operators get a clear eval error on the
old paths pointing at the rename. Single migration moment.

Per-agent options in `nix/templates/harness-base.nix` (`hyperhive.model`,
`hyperhive.allowedRecipients`, etc.) stay at `hyperhive.*` — they're
container-level config, not services in the NixOS sense.

Verified via `nix flake check --no-build` + an end-to-end NixOS eval
exercising every renamed path.

Follow-up needed: rust source comments referencing the old NixOS
option names (`hive-c0re/src/{meta,coordinator,main,dashboard}.rs`)
should be updated in a separate pure-rust PR to keep this one
strictly nix-only.

nix/modules/hive-matrix.nix

@@ -5,8 +5,8 @@
   ...
 }:
 let
-  cfg = config.hyperhive.matrix;
-  hyperhiveDomain = config.hyperhive.domain;
+  cfg = config.services.hyperhive.matrix;
+  hyperhiveDomain = config.services.hyperhive.domain;
   effectiveServerName =
     if cfg.serverName != null then cfg.serverName else "matrix.${hyperhiveDomain}";
 in
@@ -45,7 +45,7 @@ in
   # so the agent's matrix MCP client can authenticate without ever
   # seeing the shared registration token.
 
-  options.hyperhive.matrix = {
+  options.services.hyperhive.matrix = {
     enable = lib.mkOption {
       type = lib.types.bool;
       default = false;
@@ -53,7 +53,7 @@ in
         Run hive-matrix — a private matrix-tuwunel homeserver (in a
         nixos-container) for hyperhive agents. Off by default while
         the integration phases in; flip to `true` once the operator
-        has set `hyperhive.domain` and is ready to onboard agents.
+        has set `services.hyperhive.domain` and is ready to onboard agents.
       '';
     };
 
@@ -77,7 +77,7 @@ in
         (`@argus:<server_name>`) and room ID minted on this
         homeserver. CRITICAL: must be stable from day one because
         it's embedded irrevocably in the identifiers. Defaults to
-        `matrix.''${hyperhive.domain}` (always a subdomain — keeps
+        `matrix.''${services.hyperhive.domain}` (always a subdomain — keeps
         the root domain free for the dashboard or forge). Override
         here only if you need a name that doesn't follow the
         `matrix.<domain>` shape.
@@ -169,7 +169,7 @@ in
           without standing up a separate gateway.
 
           Same-origin via hive-c0re is the simplest single-host
-          shape; the post-#15 nginx-front re-root (`https://matrix.''${hyperhive.domain}`)
+          shape; the post-#15 nginx-front re-root (`https://matrix.''${services.hyperhive.domain}`)
           is tracked separately in #609. fluffychat-web supports
           per-login server pick — point it at the in-host tuwunel URL
           (`http://localhost:8008` by default) the first time.
@@ -196,17 +196,17 @@ in
     # mara on #548: "there is no default, but it is required. add
     # assertion." — fail eval with a helpful message rather than
     # spawning a homeserver with a bogus server_name we can never
-    # change later. `hyperhive.domain` is host-wide; matrix derives
+    # change later. `services.hyperhive.domain` is host-wide; matrix derives
     # the server_name from it (or from `cfg.serverName` if the
     # operator wants to override).
     assertions = [
       {
         assertion = hyperhiveDomain != null || cfg.serverName != null;
         message = ''
-          hyperhive.matrix.enable = true requires either:
-            - hyperhive.domain set to your host's canonical domain
+          services.hyperhive.matrix.enable = true requires either:
+            - services.hyperhive.domain set to your host's canonical domain
               (recommended; shared with forge / dashboard), or
-            - hyperhive.matrix.serverName set explicitly.
+            - services.hyperhive.matrix.serverName set explicitly.
 
           The matrix server_name is embedded into every user ID and
           room ID on this homeserver — it cannot be changed later