refactor(#2862): split the wireguard mesh out of swarm.nix

mara asked, and the file had already stopped being one thing: after
the gate moved off c0re.enable, swarm.nix held two concerns with
different audiences and different gates.

swarm.nix now declares WHO the peers are — data hive-c0re serialises
into HYPERHIVE_PEERS and the dashboard renders. Declaration only, no
config block.

swarm-wireguard.nix owns the mesh: assertions, the wg-hive interface,
the firewall port. That is plain host networking, and a machine which
runs no hive at all — the snapshot store — still needs it. Under the
old layout a reader could not tell which half of swarm.nix applied to
a non-hive host.

The two stay coupled by data, not by structure: the per-peer
wireguard* fields stay on the peer submodule, because that is where a
peer is described, and the mesh module reads them.

No behaviour change — same options, same gate, same rendered config.

nix/host-modules/default.nix

@@ -22,6 +22,7 @@
     ./hive-snapshot-store.nix
     ./hive-tls.nix
     ./otel.nix
+    ./swarm-wireguard.nix
     ./swarm.nix
   ];
 }