refactor: replace deprecated no-op options with mkRemovedOptionModule

nix/modules/hive-gateway/default.nix

@@ -28,8 +28,7 @@ let
   # (`tls.certDir`) nor ACME (`tls.acme.enable`) is configured, the gateway
   # generates + serves a hive-CA-signed leaf (see hive-tls.nix). There is no
   # explicit toggle and no http-only mode — matrix discovery requires https,
-  # so the gateway always terminates TLS. The deprecated `selfSignedTls`
-  # option is a no-op kept only so existing configs eval (see warnings).
+  # so the gateway always terminates TLS.
   # `cfg.useSelfSigned` (options.nix) is the derived single source of truth.
   useSelfSigned = cfg.useSelfSigned;
 in
@@ -55,20 +54,6 @@ in
       }
     ];
 
-    # Deprecation surface for the removed `selfSignedTls` toggle. Self-signed
-    # is now the implicit floor (used whenever neither `tls.certDir` nor
-    # `tls.acme` is set), so the toggle no longer does anything. Warn only
-    # when it's set to `false` — that's the case that previously meant
-    # "http-only / external-only", which no longer exists; `= true` matches
-    # the effective behaviour and stays silent to avoid noise.
-    warnings = lib.optional (!cfg.selfSignedTls) ''
-      services.hyperhive.gateway.selfSignedTls = false is deprecated and
-      ignored — self-signed TLS is now the default whenever no other TLS
-      source is configured, and there is no http-only mode. Remove the
-      setting; configure `tls.certDir` or `tls.acme` to override the
-      self-signed default.
-    '';
-
     # Ensure bind-mount sources exist at host boot before the gateway
     # container's first start. nspawn would auto-create missing dirs;
     # tmpfiles rules make the intent explicit and cover the fresh-boot
@@ -259,17 +244,15 @@ in
             inherit (nginxTree) appendHttpConfig virtualHosts;
           };
 
-          services.dnsmasq = lib.mkIf networkCfg.enable (
-            import ./dnsmasq.nix {
-              inherit
-                lib
-                networkCfg
-                forgeCfg
-                matrixCfg
-                hyperhiveDomain
-                ;
-            }
-          );
+          services.dnsmasq = import ./dnsmasq.nix {
+            inherit
+              lib
+              networkCfg
+              forgeCfg
+              matrixCfg
+              hyperhiveDomain
+              ;
+          };
         };
     };