deploy: give every option an enable, and name the controller one

Two corrections from review, applied forward on this branch rather than
by rewriting it.

`deploy.<service>` was a bare bool, which makes
`deploy.forgejo = { enable; ci; }` unrepresentable -- the nested
CI-runner sub-option this namespace was designed around. Every entry is
now an attrset with an `enable`, so a second per-host deployment
decision becomes an ordinary addition rather than a migration.

`deploy.controller` is now `deploy.swarm-controller`, consistent with
`deploy.swarm-ui`, which was introduced in the same commit.

89 references rewritten across 24 files -- nix, Rust, docs, and the
repo's own CLAUDE.md.

The prefix-anchored sweep missed exactly one, and it was live code:
hive-tls.nix spells it `hyperhiveCfg.deploy.controller` -- the only
`hyperhiveCfg` prefix among 45 references. A suffix grep
(`\.deploy\.<name>`) finds it; a path-anchored one cannot, because the
head of a reference is whatever alias the reading file happens to bind.

swarm-controller/README.md

@@ -4,7 +4,7 @@ The **swarm-level** daemon. Where `hive-c0re` owns the agents on one host, this
 owns what is true *across* hives — so a swarm runs one of them and most hives
 leave it off.
 
-Opt-in per host via `services.hyperhive.deploy.controller`, which is
+Opt-in per host via `services.hyperhive.deploy.swarm-controller.enable`, which is
 deliberately **not** derived from `services.hyperhive.enable`: turning it on is
 a statement about swarm topology, not about whether hyperhive is installed.
 

swarm-controller/src/main.rs

@@ -1,6 +1,6 @@
 //! Swarm-level controller daemon. Runs as the unprivileged
 //! `swarm-controller` user on whichever host the operator flips
-//! `services.hyperhive.deploy.controller` on, and serves HTTP over a
+//! `services.hyperhive.deploy.swarm-controller.enable` on, and serves HTTP over a
 //! unix socket that the hive-gateway's nginx proxies to.
 //!
 //! Configuration is read-only and loaded once at startup from env vars the