feat(nix): one switch for an all-on-one-host deployment

`services.hyperhive.enableAllLocalDefaults` is the single "everything
runs on this box" toggle, and the autoconfigurable settings default from
it: `swarm.enableRequiredServices` (new — the swarm's shared services
run here) and `swarm.ca.autoConfigure` (previously an explicit false).

Off by default, unchanged from before: a host cannot tell whether it is
the one meant to hold the swarm's services or its CA, so this stays an
operator saying "this is that box". What it replaces is one toggle per
service for the deployment where the answer is "all of them".

Each derived toggle can still be set on its own, so "all local except X"
needs no further option.

nix/host-modules/swarm.nix

@@ -126,6 +126,31 @@
     '';
   };
 
+  # "The swarm-wide services run HERE." A swarm has one forge, one
+  # matrix, one SSO — this says this host is where they live, and each
+  # of those services defaults its own enable from it rather than the
+  # operator enabling them one at a time.
+  options.services.hyperhive.swarm.enableRequiredServices = lib.mkOption {
+    type = lib.types.bool;
+    default = config.services.hyperhive.enableAllLocalDefaults;
+    defaultText = lib.literalExpression "services.hyperhive.enableAllLocalDefaults";
+    example = true;
+    description = ''
+      Host the swarm's shared services on this hive. The services that
+      exist once per swarm rather than once per hive — the forge, the
+      matrix homeserver, the SSO provider — default their `enable` from
+      this, so a swarm's service host is declared in one place.
+
+      Defaults from `services.hyperhive.enableAllLocalDefaults` (off),
+      which is the all-on-one-box switch. Set it directly to run the
+      swarm's services on a host that is not otherwise all-local — a
+      dedicated services box with hives elsewhere is exactly that shape.
+
+      With it off, this hive is a *client* of those services: it still
+      configures how to reach them, it just doesn't run them.
+    '';
+  };
+
   options.services.hyperhive.swarm.snapshotStore = {
     address = lib.mkOption {
       type = lib.types.nullOr lib.types.str;