swarm-controller: add configured default matrix homeserver URL

Adds services.hyperhive.deploy.swarm-controller.matrixHomeserverUrl,
threaded to the daemon as SWARM_CONTROLLER_MATRIX_HOMESERVER_URL, and a
Rust helper (homeserver_or_configured_default) that lets a caller-supplied
homeserver keep overriding it. Config plumbing only: put_matrix_account
does not call the helper yet, so this is a no-op for every current caller.

Refs #4345

nix/host-modules/swarm-controller.nix

@@ -192,6 +192,15 @@ let
     SWARM_CONTROLLER_AUTH_BRIDGE_URL = deployCfg.swarm-controller.authBridgeUrl;
   };
 
+  # Swarm-wide default for `PUT .../matrix-accounts/{account}`'s own
+  # `homeserver` field, for a request that omits one. Same shape as
+  # `authBridgeEnv` above: genuinely optional, gated on the option
+  # resolving rather than assumed. Not read by anything yet — see the
+  # option's own description.
+  matrixHomeserverEnv = lib.optionalAttrs (deployCfg.swarm-controller.matrixHomeserverUrl != null) {
+    SWARM_CONTROLLER_MATRIX_HOMESERVER_URL = deployCfg.swarm-controller.matrixHomeserverUrl;
+  };
+
   # The swarm's own display name, for `GET /api/swarm` (swarm-ui's chrome).
   # Gated on the option resolving, not defaulted to an empty string: an
   # operator who never named the swarm gets `name: null` from the
@@ -520,6 +529,24 @@ in
       '';
     };
 
+    matrixHomeserverUrl = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "https://matrix.example.org";
+      description = ''
+        Swarm-wide default homeserver for `PUT
+        .../matrix-accounts/{account}` requests that omit their own
+        `homeserver` — see that route's own doc comment
+        (`swarm-controller/src/matrix_account.rs`) for why the field is
+        optional in token mode and what omitting it currently resolves to.
+
+        `null` (the default) leaves that per-request resolution exactly as
+        it is today. **Not yet consulted by the route at all**: this option
+        only exists to carry the value in, ahead of the route being taught
+        to fall back to it.
+      '';
+    };
+
     baoClientCertFile = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
       default = null;
@@ -859,6 +886,7 @@ in
       // webhookEnv
       // authBridgeEnv
       // swarmNameEnv
+      // matrixHomeserverEnv
       // baoEnv
       // otelEnv;
     };