refactor: replace deprecated no-op options with mkRemovedOptionModule

nix/modules/hive-gateway/options.nix

@@ -12,6 +12,15 @@ let
   cfg = config.services.hyperhive.gateway;
 in
 {
+  imports = [
+    (lib.mkRemovedOptionModule [ "services" "hyperhive" "gateway" "selfSignedTls" ] ''
+      Self-signed TLS is the implicit default whenever neither
+      tls.certDir nor tls.acme is configured, and there is no http-only
+      mode. Remove the setting; configure `tls.certDir` or `tls.acme`
+      to override the self-signed default.
+    '')
+  ];
+
   options.services.hyperhive.gateway = {
     port = lib.mkOption {
       type = lib.types.port;
@@ -85,26 +94,6 @@ in
       '';
     };
 
-    selfSignedTls = lib.mkOption {
-      type = lib.types.bool;
-      default = true;
-      example = false;
-      description = ''
-        **DEPRECATED — ignored.** Self-signed TLS is now the implicit
-        default: when neither `tls.certDir` nor `tls.acme.enable` is
-        configured, the gateway generates and serves a hive-CA-signed
-        leaf (see the `hive-tls` module). There is no explicit toggle and
-        no http-only mode — matrix discovery hardcodes
-        `https://<host>/.well-known/matrix/client`, so the gateway always
-        terminates TLS. This option is retained as a no-op so existing
-        configs eval; setting it (to either value) warns and has no
-        effect, and it will be removed in a future release. Use
-        `tls.certDir` or `tls.acme` to override the self-signed default.
-
-        See `docs/gateway.md` ("Self-signed TLS").
-      '';
-    };
-
     useSelfSigned = lib.mkOption {
       type = lib.types.bool;
       internal = true;