remove certFingerprint + HYPERHIVE_PEERS plumbing (hyperhive#3294)

Mara wanted the underlying plumbing gone too, not just the dashboard
display. Traced every consumer before cutting:

- certFingerprint (services.hyperhive.swarm.hives.<name>.certFingerprint):
  removed the nix option entirely. Its only consumer was the dashboard
  code removed in the previous commits.
- HYPERHIVE_PEERS: removed entirely — the env var itself, the whole
  block that built it in hive-c0re/environment.nix, and its entry in
  meta.rs's FORWARDED_VARS (which forwarded it into every agent
  container). Turned out to have zero real consumers, not just one:
  the docs claimed hive-agent::identity::peers() read it for qualified
  agent labels, but no such function exists — identity.rs only
  qualifies THIS agent's own label with HYPERHIVE_HIVE_DOMAIN, nothing
  peer-list-related. Grepped the whole hive-agent crate to confirm
  before removing.

services.hyperhive.swarm.peerHives (the nix option HYPERHIVE_PEERS was
built from) is untouched — swarm-wireguard.nix reads it directly for
the wg-hive mesh, a real and unrelated consumer.

Verified: cargo build/clippy/test -p hive-c0re -p swarm-controller all
clean (needed nix develop -c per the usual -lsqlite3 gap), all touched
nix files pass nix-instantiate --parse, and a throwaway nixosSystem
eval confirms the wireguard mesh still configures a peer's
wireguardAddress into wg-hive correctly with certFingerprint gone.

nix/host-modules/hive-c0re/environment.nix

@@ -209,28 +209,3 @@ in
     in
     "${s.address}:${toString s.port}";
 }
-// lib.optionalAttrs (config.services.hyperhive.swarm.peerHives != { }) {
-  # Peer hives serialised as a JSON array of {domain, cert_fingerprint,
-  # wireguard_address?} objects. Consumed by hive-agent::identity::peers().
-  # `cert_fingerprint` is currently unconsumed (was read only by the
-  # per-hive dashboard's now-removed "peer hives" display — see
-  # docs/swarm/README.md's certFingerprint note); still emitted here
-  # since the shape is shared with `wireguard_address`, which is not
-  # dead. `cert_fingerprint` is null for CA-trusted hives;
-  # `wireguard_address` is omitted when not part of the mesh.
-  #
-  # Reads `peerHives` — `swarm.hives` minus this hive — so the "not me"
-  # filter is the one derived in ../swarm.nix rather than a fifth copy.
-  HYPERHIVE_PEERS = builtins.toJSON (
-    lib.mapAttrsToList (
-      _name: p:
-      {
-        inherit (p) domain;
-        cert_fingerprint = p.certFingerprint;
-      }
-      // lib.optionalAttrs (p.wireguardAddress != null) {
-        wireguard_address = p.wireguardAddress;
-      }
-    ) config.services.hyperhive.swarm.peerHives
-  );
-}