deploy: separate "what this host deploys" from swarm-wide truth

`services.hyperhive.swarm.*` is meant to be identical on every host in a
swarm — it describes the swarm, and every hive needs all of it to be a
client. But it also carried the `enable` toggles, which are precisely the
values that must differ per machine. The namespace that should be the
same everywhere held the one thing that cannot be.

Adds `services.hyperhive.deploy.*` for a host's deployment decisions, and
moves the first of them (`swarm.grafana.enable` -> `deploy.grafana`) as
the pattern for the rest. Flat and named for the thing deployed rather
than grouped under a "swarm services" attribute: from the deploy side it
does not matter what kind of thing each one is, and a grouping by service
kind would re-encode the service-side taxonomy into a layer that does not
care about it.

Behaviour is unchanged. The move is a rename in the strict sense — same
type, same meaning, new path — so `mkRenamedOptionModule` carries it and
existing configs keep evaluating with one warning naming both paths. The
renames live in the new module rather than the service modules, so the
whole migration has a single home and a single file to delete when the
deprecation window closes.

docs/swarm/services.md

@@ -75,7 +75,7 @@ empty. To run one without the other, set it directly:
 
 ```nix
 services.hyperhive.swarm.victoriametrics.enable = true;
-services.hyperhive.swarm.grafana.enable = false;
+services.hyperhive.deploy.grafana = false;
 ```
 
 ⚠️ **This starts a database that grows for as long as the swarm runs.**