swarm: remove swarm.ui.domain, serve the UI on the swarm domain

The UI and the swarm-controller it fronts are one service to a reader and to a
certificate, so a separate option only ever created two spellings of one
address — and the controller's own public URL was built from one of them while
an allow-list entry named the other.

Removed rather than aliased. A config still setting it was pinning a name the
controller never used; an alias would preserve exactly that mismatch, so
`mkRemovedOptionModule` says so and fails the build.

⚠️ The option was TOTAL and `swarm.domain` is NULLABLE. That is not incidental:
`ui.domain` fell back to `swarm.invalid` so hive-network.nix's required-domain
assertion is what an operator sees, rather than a coercion error from a
consumer. Each site keeps that property its own way — swarm-ui binds a local
total (the idiom swarm-otel.nix already uses as `domainBase`), and the three
sites already gated on `deploy.swarm-ui.enable` gain `&& domain != null`, which
is stricter than a placeholder and puts no invented name into rendered config.

One behaviour change worth naming: `swarm.nix`'s certificate SAN list used to
receive the placeholder `swarm.invalid` on a null domain and now receives
nothing. `lib.optional` would otherwise have put a literal `null` in it.

Verified with `checks.module-eval` rather than `nix-instantiate --parse`: parse
proves syntax, and every failure this change could plausibly cause — a dead
binding, a renamed reference — is an evaluation error.

nix/host-modules/swarm-authelia.nix

@@ -41,7 +41,6 @@ let
   gatewayCfg = hyperhiveCfg.gateway;
   hyperhiveDomain = hyperhiveCfg.domain;
   swarmDomain = hyperhiveCfg.swarm.domain;
-  uiCfg = hyperhiveCfg.swarm.ui;
   deployCfg = hyperhiveCfg.deploy;
   forgeCfg = hyperhiveCfg.swarm.forge;
 
@@ -1399,8 +1398,10 @@ in
                   # collector is registered — see `metricsRule` above,
                   # which is where the reasoning for both halves lives.
                   lib.optional forgeCfg.behindGateway metricsRule
-                  ++ lib.optional deployCfg.swarm-ui.enable {
-                    domain = uiCfg.domain;
+                  # Also guarded on the domain being set: without it a null
+                  # apex would render a rule matching the string "null".
+                  ++ lib.optional (deployCfg.swarm-ui.enable && swarmDomain != null) {
+                    domain = swarmDomain;
                     subject = [ "group:${operatorGroup}" ];
                     policy = "one_factor";
                   };