feat(#569): wireguard inter-hive mesh option

Add opt-in WireGuard mesh support to services.hyperhive.swarm:

- swarm.peers.<domain>.wireguardPublicKey — peer's wg public key
- swarm.peers.<domain>.wireguardEndpoint  — peer's UDP endpoint (optional)
- swarm.peers.<domain>.wireguardAddress   — peer's mesh IP with prefix

- swarm.wireguard.enable           — bring up wg-hive interface
- swarm.wireguard.privateKeyFile   — path to host's wg private key
- swarm.wireguard.address          — this host's mesh IP/prefix
- swarm.wireguard.listenPort       — UDP listen port (default 51820)
- swarm.wireguard.persistentKeepalive — keepalive seconds (default 25)

When enabled, generates networking.wireguard.interfaces.wg-hive with
one peer entry per mesh-enabled swarm.peers entry. Opens listenPort
UDP on the host firewall. Adds wireguard_address to HYPERHIVE_PEERS
JSON so hive-c0re can use mesh IPs for intra-swarm routing.

Assertions guard against enable=true without privateKeyFile or address.

Also refactors networking.firewall.allowedTCPPortRanges from the
nested attrset form (which conflicted with the new allowedUDPPorts
line) to the per-attribute form.

docs/swarm.md: adds WireGuard setup section with key generation
commands, two-hive config example, NAT/keepalive notes.

docs/swarm.md

@@ -93,6 +93,79 @@ services.hyperhive.swarm.peers."pr1ma.example.com" = { certFingerprint = "sha256
 Mixed trust is fine: A trusts B via CA bundle (no fingerprint), B
 pins A's self-signed cert.
 
+## WireGuard inter-hive mesh (optional)
+
+The peer config above uses public HTTPS for all inter-hive traffic.
+For private deployments — or to reduce latency and TLS overhead on
+intra-swarm traffic — hive-c0re can configure a host-to-host
+WireGuard mesh.
+
+### Generating keys
+
+On each hive host:
+
+```bash
+wg genkey | install -m 0400 /dev/stdin /etc/wireguard/hive.key
+wg pubkey < /etc/wireguard/hive.key   # → share this with peer operators
+```
+
+### Config example (two hives)
+
+```nix
+# hive A (pr1ma.example.com, mesh IP 10.100.0.1)
+services.hyperhive = {
+  swarm.wireguard = {
+    enable        = true;
+    privateKeyFile = "/etc/wireguard/hive.key";
+    address        = "10.100.0.1/24";
+    listenPort     = 51820;          # optional, default 51820
+  };
+
+  swarm.peers."edge.corp" = {
+    certFingerprint    = "sha256:…";   # TLS trust (unchanged)
+    wireguardPublicKey = "base64key="; # peer's wg pubkey
+    wireguardEndpoint  = "203.0.113.42:51820"; # peer's public IP:port
+    wireguardAddress   = "10.100.0.2/32";      # peer's mesh IP
+  };
+};
+
+# hive B (edge.corp, mesh IP 10.100.0.2)
+services.hyperhive = {
+  swarm.wireguard = {
+    enable        = true;
+    privateKeyFile = "/etc/wireguard/hive.key";
+    address        = "10.100.0.2/24";
+  };
+
+  swarm.peers."pr1ma.example.com" = {
+    wireguardPublicKey = "base64key="; # hive A's wg pubkey
+    wireguardEndpoint  = "198.51.100.1:51820";
+    wireguardAddress   = "10.100.0.1/32";
+  };
+};
+```
+
+### What the mesh does
+
+- `networking.wireguard.interfaces.wg-hive` is configured on the host
+  (not inside agent containers; containers reach peers via the host's
+  routing table).
+- UDP port 51820 (or `listenPort`) is opened on the host firewall.
+- `HYPERHIVE_PEERS` gains a `wireguard_address` field for each mesh
+  peer so hive-c0re can reach intra-swarm services without a public
+  DNS round-trip.
+- `persistentKeepalive = 25` is set by default; override or null to
+  disable (not needed when both sides have public IPs and no NAT).
+
+### NAT / one-sided endpoints
+
+If one host is behind NAT and can't accept incoming connections, only
+that host needs a null `wireguardEndpoint` on the peer config — the
+other side initiates. With keepalive on, the NAT hole stays open.
+
+If both hosts are behind NAT, a STUN relay or a third host (exit node)
+is required. Out of scope for v0.
+
 ## Cross-references
 
 - `docs/conventions.md` § Hive identity — env vars, qualified labels