nix: stop three defaults from consulting hyperhive.enable

hive-forge's publicUrl and behindGateway, and swarm-controller's
forgeTokenFile, no longer gate their default on
config.services.hyperhive.enable — none of the three has a reader that
depends on hyperhive being enabled to make sense of the value, so the
extra condition only added a hidden coupling. module-eval.nix gains a
centralToggleOff fixture plus four cases asserting each affected
default now resolves identically whether the toggle is on or off.

Refs #4500

nix/host-modules/hive-ci.nix

@@ -167,8 +167,7 @@ in
           services.hyperhive.deploy.forgejo.behindGateway = true.
           The CI container runs with a private network namespace and
           reaches the forge through the gateway vhost on the bridge IP.
-          Set behindGateway = true (it defaults to true alongside
-          services.hyperhive.enable).
+          Set behindGateway = true (it is the default).
         '';
       }
     ];