deploy: move the queue's callout identity out of swarm.nats

`swarm.*` is what a hive needs to be a *client* of the swarm. For the
queue that is the ports it answers on, the client id it is registered
under, and the responder package. Whether this host mints its own
auth-callout keypairs and where the seeds sit are decisions of the
machine running it, so autoGenerateCallout, both seed files and both
public keys move to `deploy.nats.*`.

The two PUBLIC keys are the non-obvious half, so the reasoning is here
rather than in a comment nobody re-reads. A public key looks swarm-wide,
and docs/swarm/secrets.md says the user key "is published to every
client that connects" — which is true and does not make it swarm
config: peers RECEIVE it over the wire at connect time, they never
configure it. What decides the placement is that its seed is
unambiguously host-side, and splitting a keypair across two namespaces
is worse than either placement.

local-defaults.nix set `nats.autoGenerateCallout` from INSIDE
`config.services.hyperhive.swarm = { ... }`, so the bare prefix meant
`swarm.nats` and no full-path grep could see it. It moves out of that
block into a `deploy` statement rather than being rewritten in place.

swarm-controller.nix bound `natsCfg` and never used it — one mention,
no bare pass, while its sibling bindings have 5 and 10. Pre-existing
dead code, found by this slice's own alias sweep, removed with it.

Four assertion messages and five doc lines named moved options by a
short form (`nats.calloutUserSeedFile`) that is ambiguous now that both
`swarm.nats` and `deploy.nats` exist; one opened with
"services.hyperhive.swarm.nats has callout public keys", which the split
makes false. Prose that names a VALUE rather than a path — the `nk`
pipeline's `# -> calloutUserPublicKey` — is left bare on purpose.

module-eval configures a hive through all five OLD paths and asserts the
responder's delivery unit exists and interpolates the seed path.
`autoGenerateCallout` is deliberately FALSE there: that is what makes
the seed options decide `responderConfigured`, so the assertion is about
the seeds rather than about the auto-mint branch.

nix/host-modules/deploy.nix

@@ -98,6 +98,37 @@ in
       [ "services" "hyperhive" "deploy" "forgejo" "ci" "package" ]
     )
 
+    # The queue's callout identity. What stays under `swarm.nats` is what the
+    # queue IS to every hive — the ports it answers on, the client id it is
+    # registered under, the responder package; these five are what the host
+    # running it decides.
+    #
+    # ⚠️ The two PUBLIC keys move with their seeds. A public key looks
+    # swarm-wide, and the user key genuinely is published to every client that
+    # connects — but peers RECEIVE it over the wire, they never configure it,
+    # and splitting a keypair across two namespaces is worse than either
+    # placement. `enable` moved earlier; its shim is the one above.
+    (lib.mkRenamedOptionModule
+      [ "services" "hyperhive" "swarm" "nats" "autoGenerateCallout" ]
+      [ "services" "hyperhive" "deploy" "nats" "autoGenerateCallout" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "hyperhive" "swarm" "nats" "calloutUserPublicKey" ]
+      [ "services" "hyperhive" "deploy" "nats" "calloutUserPublicKey" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "hyperhive" "swarm" "nats" "calloutIssuerPublicKey" ]
+      [ "services" "hyperhive" "deploy" "nats" "calloutIssuerPublicKey" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "hyperhive" "swarm" "nats" "calloutUserSeedFile" ]
+      [ "services" "hyperhive" "deploy" "nats" "calloutUserSeedFile" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "hyperhive" "swarm" "nats" "calloutIssuerSeedFile" ]
+      [ "services" "hyperhive" "deploy" "nats" "calloutIssuerSeedFile" ]
+    )
+
     # The rest of the forge split. What stays under `swarm.forge` is what the
     # forge IS from any hive's point of view — its package, the names and ports
     # it answers on, the URLs it advertises, the client id it is registered