nix: stop three defaults from consulting hyperhive.enable

hive-forge's publicUrl and behindGateway, and swarm-controller's
forgeTokenFile, no longer gate their default on
config.services.hyperhive.enable — none of the three has a reader that
depends on hyperhive being enabled to make sense of the value, so the
extra condition only added a hidden coupling. module-eval.nix gains a
centralToggleOff fixture plus four cases asserting each affected
default now resolves identically whether the toggle is on or off.

Refs #4500

nix/host-modules/hive-ci.nix

@@ -167,8 +167,7 @@ in
           services.hyperhive.deploy.forgejo.behindGateway = true.
           The CI container runs with a private network namespace and
           reaches the forge through the gateway vhost on the bridge IP.
-          Set behindGateway = true (it defaults to true alongside
-          services.hyperhive.enable).
+          Set behindGateway = true (it is the default).
         '';
       }
     ];

nix/host-modules/hive-forge/default.nix

@@ -200,11 +200,7 @@ in
 
     publicUrl = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default =
-        if config.services.hyperhive.enable && deployCfg.forgejo.behindGateway then
-          "https://${cfg.domain}"
-        else
-          null;
+      default = if deployCfg.forgejo.behindGateway then "https://${cfg.domain}" else null;
       defaultText = lib.literalExpression ''
         if behindGateway then "https://''${domain}" else null
       '';
@@ -303,8 +299,7 @@ in
 
     behindGateway = lib.mkOption {
       type = lib.types.bool;
-      default = config.services.hyperhive.enable;
-      defaultText = lib.literalExpression "config.services.hyperhive.enable";
+      default = true;
       description = ''
         Serve forgejo through the hive-gateway nginx as a sub-domain
         vhost (`server_name = cfg.domain`) instead of directly on
@@ -318,8 +313,8 @@ in
         - `gateway.localHostsEntry = true` extends `/etc/hosts` to
           include `cfg.domain → 127.0.0.1` for local dev.
 
-        Defaults to `services.hyperhive.enable` (the gateway always runs
-        alongside hyperhive, so forge auto-routes through it). Set `false`
+        Defaults to `true` (the gateway always runs alongside
+        hyperhive, so forge auto-routes through it). Set `false`
         explicitly to keep forge on the direct port even though the
         gateway is running (e.g. an external git client that doesn't
         traverse the gateway).

nix/host-modules/swarm-controller.nix

@@ -502,21 +502,16 @@ in
 
     forgeTokenFile = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      # The forge has no `enable` of its own to check — neither half of
-      # its split namespace carries one — the module activates on the general
-      # `config.services.hyperhive.enable` instead (see
-      # `hive-forge/default.nix`'s own `config = lib.mkIf
-      # config.services.hyperhive.enable { ... }`), so that's the
-      # condition to match here too. Referencing a `forge.enable` that
-      # doesn't exist threw `attribute 'enable' missing` on every host
-      # that turns swarm-controller on — caught in review, not by
-      # `nix flake check` (nothing in its checked combinations forced
-      # this particular default to actually evaluate).
-      default =
-        if config.services.hyperhive.enable then deployCfg.forgejo.hostSwarmControllerTokenFile else null;
+      # The forge has no `enable` of its own to condition this on —
+      # neither half of its split namespace carries one — and it deploys
+      # unconditionally wherever the rest of the stack does, so its own
+      # delivery path is simply the right default. The controller's units
+      # are the thing that decides whether the file is ever read: they only
+      # exist under `deploy.swarm-controller.enable`, and a host whose forge
+      # lives elsewhere overrides this (or sets `null`) explicitly.
+      default = deployCfg.forgejo.hostSwarmControllerTokenFile;
       defaultText = lib.literalExpression ''
-        forge's own `hostSwarmControllerTokenFile` when this host runs
-        hyperhive at all (forge has no separate enable), else null
+        config.services.hyperhive.deploy.forgejo.hostSwarmControllerTokenFile
       '';
       example = "/var/lib/secrets/swarm-controller-forge.token";
       description = ''
@@ -525,8 +520,8 @@ in
         `forgejo-swarm-controller-account` + `hive-forge-swarm-controller-token`
         units, which mint and collect it onto forge's own host).
 
-        Defaults to forge's own delivery path on every host running
-        hyperhive (forge deploys unconditionally alongside it — see
+        Defaults to forge's own delivery path (forge deploys
+        unconditionally alongside the rest of the stack — see
         `hive-forge/default.nix`, it has no `enable` of its own).
         Override explicitly if forge's actual token file ends up
         somewhere else — copy it out of forge's