remove certFingerprint + HYPERHIVE_PEERS plumbing (hyperhive#3294)

Mara wanted the underlying plumbing gone too, not just the dashboard
display. Traced every consumer before cutting:

- certFingerprint (services.hyperhive.swarm.hives.<name>.certFingerprint):
  removed the nix option entirely. Its only consumer was the dashboard
  code removed in the previous commits.
- HYPERHIVE_PEERS: removed entirely — the env var itself, the whole
  block that built it in hive-c0re/environment.nix, and its entry in
  meta.rs's FORWARDED_VARS (which forwarded it into every agent
  container). Turned out to have zero real consumers, not just one:
  the docs claimed hive-agent::identity::peers() read it for qualified
  agent labels, but no such function exists — identity.rs only
  qualifies THIS agent's own label with HYPERHIVE_HIVE_DOMAIN, nothing
  peer-list-related. Grepped the whole hive-agent crate to confirm
  before removing.

services.hyperhive.swarm.peerHives (the nix option HYPERHIVE_PEERS was
built from) is untouched — swarm-wireguard.nix reads it directly for
the wg-hive mesh, a real and unrelated consumer.

Verified: cargo build/clippy/test -p hive-c0re -p swarm-controller all
clean (needed nix develop -c per the usual -lsqlite3 gap), all touched
nix files pass nix-instantiate --parse, and a throwaway nixosSystem
eval confirms the wireguard mesh still configures a peer's
wireguardAddress into wg-hive correctly with certFingerprint gone.

hive-c0re/src/meta.rs

@@ -703,7 +703,6 @@ const FORWARDED_VARS: &[&str] = &[
     "HIVE_FORGE_URL",
     "HIVE_FORGE_PUBLIC_URL",
     "HIVE_MATRIX_URL",
-    "HYPERHIVE_PEERS",
     "HYPERHIVE_HIVE_DOMAIN",
     "HYPERHIVE_HIVE_NAME",
     "HYPERHIVE_SWARM_NAME",

nix/host-modules/hive-c0re/environment.nix

@@ -209,28 +209,3 @@ in
     in
     "${s.address}:${toString s.port}";
 }
-// lib.optionalAttrs (config.services.hyperhive.swarm.peerHives != { }) {
-  # Peer hives serialised as a JSON array of {domain, cert_fingerprint,
-  # wireguard_address?} objects. Consumed by hive-agent::identity::peers().
-  # `cert_fingerprint` is currently unconsumed (was read only by the
-  # per-hive dashboard's now-removed "peer hives" display — see
-  # docs/swarm/README.md's certFingerprint note); still emitted here
-  # since the shape is shared with `wireguard_address`, which is not
-  # dead. `cert_fingerprint` is null for CA-trusted hives;
-  # `wireguard_address` is omitted when not part of the mesh.
-  #
-  # Reads `peerHives` — `swarm.hives` minus this hive — so the "not me"
-  # filter is the one derived in ../swarm.nix rather than a fifth copy.
-  HYPERHIVE_PEERS = builtins.toJSON (
-    lib.mapAttrsToList (
-      _name: p:
-      {
-        inherit (p) domain;
-        cert_fingerprint = p.certFingerprint;
-      }
-      // lib.optionalAttrs (p.wireguardAddress != null) {
-        wireguard_address = p.wireguardAddress;
-      }
-    ) config.services.hyperhive.swarm.peerHives
-  );
-}

nix/host-modules/swarm.nix

@@ -10,12 +10,11 @@
 # could hold different endpoints for the same third hive and nothing
 # detected it. One entry per hive makes that unrepresentable.
 #
-# Consumed by hive-c0re's environment (HYPERHIVE_PEERS — see
+# Consumed by swarm-controller's own hive directory (its `/api/hives`,
-# ./hive-c0re), identity.rs, swarm-controller's own hive directory (its
+# swarm-controller.nix) and the mesh in ./swarm-wireguard.nix. The mesh
-# `/api/hives`, swarm-controller.nix), and the mesh in
+# lives there rather than here because bringing up an interface is
-# ./swarm-wireguard.nix. The mesh lives there rather than here because
+# host networking rather than swarm bookkeeping, and a host that runs
-# bringing up an interface is host networking rather than swarm
+# no hive still needs it.
-# bookkeeping, and a host that runs no hive still needs it.
 {
   lib,
   config,
@@ -76,8 +75,10 @@ in
               defaultText = lib.literalExpression ''"''${name}.''${services.hyperhive.swarm.domain}"'';
               example = "lab.example.com";
               description = ''
-                Public DNS domain this hive occupies — used for dashboard
+                Public DNS domain this hive occupies — used for
-                links, peer HTTPS checks and Matrix federation discovery.
+                swarm-controller's hive roster, agent identity
+                (qualified `agent@domain` labels), and Matrix federation
+                discovery.
 
                 Defaults to `<name>.<swarm.domain>`, the convention every
                 hive in a swarm follows, so a conventional directory is
@@ -86,33 +87,6 @@ in
               '';
             };
 
-            certFingerprint = lib.mkOption {
-              type = lib.types.nullOr lib.types.str;
-              default = null;
-              example = "sha256:b1946ac92492d2347c6235b4d2611184a3f5b6cae6c19d6e3c2f0a8e7d4c9f12";
-              description = ''
-                Expected TLS certificate fingerprint for this hive's HTTPS
-                endpoint. Null = trust the CA bundle — which for a hive
-                inside the swarm CA hierarchy is the normal case, since
-                every hive under the swarm root already chains to it.
-                Set it to pin a leaf that no CA in the bundle vouches for.
-
-                Format: the literal `sha256:` followed by exactly 64
-                hex digits (case-insensitive, no colon separators) — the
-                SHA-256 digest of the DER-encoded leaf certificate.
-                Generate with `openssl x509 -noout -fingerprint -sha256`,
-                then strip the colons and prepend `sha256:`. A malformed
-                value is ignored with a warning rather than weakening
-                trust. See docs/swarm/README.md for the full recipe.
-
-                Scopes only to hive-c0re's own peer HTTPS checks — it does
-                NOT help Matrix federation, which validates against the
-                container's trust bundle. There is no per-hive CA field to
-                cover that case any more: the swarm root is the trust path
-                (see ./swarm-ca.nix).
-              '';
-            };
-
             wireguardPublicKey = lib.mkOption {
               type = lib.types.nullOr lib.types.str;
               default = null;
@@ -147,9 +121,9 @@ in
               description = ''
                 IP address (with prefix) of this hive's host on the
                 WireGuard mesh. Used as the `allowedIPs` for its
-                WireGuard config entry and injected into `HYPERHIVE_PEERS`
+                WireGuard config entry (`./swarm-wireguard.nix`), so
-                so hive-c0re can route intra-swarm traffic to the mesh
+                intra-swarm traffic can route over the mesh address
-                address rather than the public domain. Required to include
+                rather than the public domain. Required to include
                 a hive in the mesh (entries missing this field are
                 silently excluded from `wg-hive`).
               '';