move the small per-service host options to deploy.<service>

nix/host-modules/swarm-bao.nix

@@ -1604,7 +1604,7 @@ let
     baoDeploy.uiPort
     (baoDeploy.uiPort + 1)
     baoDeploy.uiProxyPort
-    cfg.otel.telemetryPort
+    baoDeploy.otel.telemetryPort
   ];
 
   # Paths a browser session has no business sending to the store: they unseal,
@@ -2772,6 +2772,27 @@ in
       '';
     };
 
+    otel.telemetryPort = lib.mkOption {
+      type = lib.types.port;
+      default = 8890;
+      description = ''
+        Port the collector inside the store's container serves its **own**
+        metrics on — queue depth, refused and dropped samples, exporter
+        failures. How you find out that telemetry is being lost, so it is
+        worth keeping rather than switching off.
+
+        ⚠️ **Deliberately not 8888.** 8888 is the collector
+        binary's built-in default, which the hive tier
+        ({option}`services.hyperhive.otel.telemetryPort`) already binds. This
+        container runs with `privateNetwork = false`, so both share the
+        host's network namespace whenever they are co-located — and unlike
+        the OTLP ports this one appears nowhere in either config when it is
+        left undeclared, so nothing that compares configured ports can see
+        the clash. The second collector to start simply dies with
+        `bind: address already in use`.
+      '';
+    };
+
     metricsPort = lib.mkOption {
       type = lib.types.port;
       default = 8202;
@@ -2879,7 +2900,7 @@ in
             services.hyperhive.swarm.bao.port and +1, deploy.bao.metricsPort and
             +1, deploy.bao.uiPort and +1 (openbao binds each listener's port + 1
             as its cluster address), deploy.bao.uiProxyPort, and
-            swarm.bao.otel.telemetryPort. Pick free ports.
+            deploy.bao.otel.telemetryPort. Pick free ports.
           '';
         }
         {
@@ -4603,7 +4624,7 @@ in
                 # holds: this container shares the host's netns.
                 (import ../collector-self-scrape.nix {
                   inherit lib;
-                  port = cfg.otel.telemetryPort;
+                  port = baoDeploy.otel.telemetryPort;
                   exporter = "otlphttp";
                   attributes.container = collectorServiceName;
                 })