deploy: which host runs the secret store is its own decision

A swarm has one store, so running it is a fact about this machine and
belongs beside the other deploy.* toggles rather than in the namespace
every host agrees on. Attrset with an enable, not a bare bool, so a
second deployment decision has somewhere to go.

Asserted from swarm.enableRequiredServices alongside the other
once-per-swarm services, and asserted as a mkDefault -- which is what
keeps *where* the store runs a separate question from *that* it runs.
Set it directly to put the store on a host of its own; a hive that does
not run it is a client either way, reaching it by name.

Two descriptions in the file still narrated the old swarm.* layout as
something that used to be true, and the queue's claimed it belongs on
the shared-services host. Both now say what holds.

nix/host-modules/swarm-required-services.nix

@@ -90,4 +90,11 @@ in
   # hive that is not the service host is a *client* of it, not a second one.
   config.services.hyperhive.deploy.victorialogs.enable =
     lib.mkDefault swarmCfg.enableRequiredServices;
+
+  # The secret store. Once per swarm and optional, so it belongs to the
+  # same switch: a hive that does not run it is a *client*, reading its
+  # own secrets from whoever does. `mkDefault` is what keeps the store
+  # placeable on a host of its own — it can be set directly here and
+  # turned off wherever this switch happens to be on.
+  config.services.hyperhive.deploy.bao.enable = lib.mkDefault swarmCfg.enableRequiredServices;
 }