fix(nix): keep the domain-derived defaults total

The required-domain assertion in hive-network.nix could not be reached:
`forge.<domain>` and `matrix.<domain>` are evaluated while the
assertion list is, so an unset domain threw `cannot coerce null to a
string` naming one of those options instead of printing the message
that says which option to set.

Both defaults now fall back to a name under the reserved `.invalid`
TLD, which the assertion refuses to let out the door.

nix/host-modules/hive-network.nix

@@ -153,6 +153,17 @@ in
     # hyperhive is enabled: the shared-netns mode was removed, so there
     # is one mode (private netns behind the bridge).
     (lib.mkIf config.services.hyperhive.enable {
+      # This message is only useful if an operator can actually reach
+      # it, and an assertion competes with every eager default that
+      # reads the value it guards: option defaults that interpolate the
+      # domain (`forge.<domain>`, `matrix.<domain>`) throw while the
+      # assertion list is being evaluated, so the operator sees
+      # `cannot coerce null to a string` naming an unrelated option
+      # instead of the sentence below. Those defaults therefore stay
+      # total, falling back to a name under the reserved `.invalid` TLD
+      # (RFC 2606) — a value this assertion then refuses to let out the
+      # door, and one that fails loudly at resolution rather than
+      # quietly working if it somehow did.
       assertions = [
         {
           assertion = config.services.hyperhive.domain != null;