nix: drop the central-toggle conjunct from four compound gates

`services.hyperhive.enable` is going away (Refs #4500). These four blocks
ANDed it with a second condition that was already the load-bearing one:
the bridge-firewall hole asks whether an operator named any
`network.exposeHostPorts`, and the three swarm-level services ask their
own `deploy.*.enable`, each of which defaults false (swarm-ui derives
from the controller's toggle, a sibling deployment decision) and none of
which is derived from the hive toggle. So dropping the conjunct turns
nothing on by itself — the remaining condition still decides.

The way that claim fails is by something becoming unconditional, so
module-eval gets absence arms for all four, each asserted on a host with
the hive ON and on one with it OFF, plus the two controls that make the
absences mean something.

The swarm-controller arm is probed by the credential oneshot and by the
daemon's `ExecStart` rather than by the unit name: hive-tls defines an
environment key on that name, which leaves an inert fragment behind on
any hive with a CA whether or not the controller runs there.

nix/host-modules/hive-network.nix

@@ -276,7 +276,7 @@ in
     # is firewall-only by design: a host service that binds `0.0.0.0` already
     # serves the bridge IP, so an extra bridge-IP proxy would only collide
     # (EADDRINUSE) with it. Merges with the [ 80 443 ] gateway ports above.
-    (lib.mkIf (config.services.hyperhive.enable && cfg.exposeHostPorts != [ ]) {
+    (lib.mkIf (cfg.exposeHostPorts != [ ]) {
       networking.firewall.interfaces.${cfg.bridgeName}.allowedTCPPorts = cfg.exposeHostPorts;
     })
   ];