move the small per-service host options to deploy.<service>

nix/host-modules/hive-matrix-service.nix

@@ -90,25 +90,6 @@ in
       '';
     };
 
-    allowEncryption = lib.mkOption {
-      type = lib.types.bool;
-      default = false;
-      description = ''
-        Server-side switch for matrix end-to-end encryption — sets
-        tuwunel's `allow_encryption`. Off by default: on the hive-internal
-        homeserver the operator already controls the transport, so server
-        E2EE adds key-management overhead (cross-signing, device
-        verification, undecryptable-message recovery) without a clear
-        threat-model win for the common single-hive case. Turn on when
-        agents join encrypted rooms on external / federated homeservers,
-        or when the operator wants message contents opaque to the
-        homeserver admin. Independent of the agent matrix client, which
-        always supports decryption so it can read encrypted rooms it is
-        invited to regardless of this flag; this option only governs
-        whether THIS homeserver permits room encryption.
-      '';
-    };
-
     adminSync.ignoreUsers = lib.mkOption {
       type = lib.types.listOf (lib.types.strMatching "@[^:[:space:]]+:[^[:space:]]+");
       default = [ ];