refactor(nix): swarm.peers becomes swarm.hives, a directory of every hive

One attrset describing every hive in the swarm including this one,
identical on every host, with hiveName selecting which entry is us.
"My peers" is derived (swarm.peerHives) rather than declared.

Every field in the old per-host peer list was intrinsic to the hive it
described, never to the pair -- so the list was a directory each host
kept its own copy of. Beyond the deduplication it removes a bug class:
two hosts could hold different endpoints for the same third hive with
nothing to detect the disagreement.

Drops the per-hive caCert. Trust inside a swarm derives from the swarm
root, which every hive chains to. What that genuinely removes is
trusting a hive whose root this swarm does not own -- a cross-swarm
problem that wants a mechanism of its own, not a field that happened to
work.

The matrix container's certificateFiles block goes with it and could
NOT be migrated: that list is read at build time and the swarm root is
a runtime file (its key must never enter the store), so there is no
build-time name to put there. caCert being a nix path was precisely
what made it the build-time distribution channel. Agents are unaffected
-- hive-tls folds the root into the hive trust bundle and the meta
renderer embeds that one file. Tracked separately.

Migration is an assertion plus warnings, not a rename: hives is peers
union {self}, and the set gains a member no existing config has written
down. A rename migrates a name and a default can re-root a meaning;
neither can conjure a new member. The warning explains, the self-entry
assertion stops the build.

nix/host-modules/hive-matrix.nix

@@ -395,20 +395,20 @@ in
           # all filtering; never run one in here.
           networking.firewall.enable = false;
 
-          # Peer-hive root CAs (`swarm.peers.<domain>.caCert`) added to THIS
-          # container's trust bundle so tuwunel validates *federation* TLS
-          # from a self-signed peer hive (it checks the peer's federation
-          # cert against its trust bundle). Peer CAs are trusted everywhere
-          # the hive's own internal CA is — agents get them via the
-          # meta-flake renderer (`HIVE_PEER_CA_PATHS` → each agent's
-          # `security.pki.certificateFiles`); this block is the matrix
-          # container's copy, since the host `security.pki` store doesn't
-          # cross the container boundary. They are never installed in the
-          # HOST trust store. Null entries (CA-bundle / fingerprint-pinned
-          # peers) drop out.
-          security.pki.certificateFiles = lib.filter (c: c != null) (
-            lib.mapAttrsToList (_domain: p: p.caCert) config.services.hyperhive.swarm.peers
-          );
+          # ⚠️ This container trusts no swarm-internal CA. It used to take
+          # per-hive root CAs, hand-pinned as nix paths, so tuwunel could
+          # validate *federation* TLS from a self-signed peer hive; that
+          # field is gone, and the swarm root that replaces it cannot be
+          # substituted here. `security.pki.certificateFiles` is read when
+          # the system is BUILT, and the swarm root is a runtime file
+          # (`swarm.ca.stateDir`) precisely because its key must never
+          # reach the store — so there is nothing build-time to name.
+          #
+          # Giving the container the swarm root therefore needs a runtime
+          # mechanism (bind-mount + a bundle assembled at start), which is
+          # a different shape than this line and is tracked as its own
+          # issue. Federation with a peer whose cert chains to the swarm
+          # root does not validate until then.
 
           # tuwunel hard-fails to boot if `/etc/resolv.conf` has no
           # `nameserver` line (`Failed to configure DNS resolver ... no