move the squid host options to deploy.hive-controller.squid

docs/networking/network.md

@@ -225,7 +225,7 @@ host. It never decrypts TLS, so it holds no signing key. It caches nothing.
   credential (HTTP Basic, the agent's name and its secret). `swarm-controller`
   mints one per agent at `swarm/agents/<agent>/proxy-credential`, and never
   replaces it. `hive-c0re` hashes the credentials of this hive's agents, and
-  one more for the self-check, into `services.hyperhive.squid.usersFile`
+  one more for the self-check, into `services.hyperhive.deploy.hive-controller.squid.usersFile`
   every 30 seconds. Squid's `basic_ncsa_auth` helper re-reads the file when it
   changes. A stopped agent stays in the file. Squid caches a good login for a
   minute. Nothing rotates a credential: to replace one, delete its leaf in the
@@ -238,7 +238,7 @@ host. It never decrypts TLS, so it holds no signing key. It caches nothing.
 - **Agents and the proxy.** An agent uses the proxy only when its hive says
   this host's squid is ready for it. `hive-c0re` puts two facts in every
   container's `/etc/hyperhive-hive-facts`, only on a hive that holds a store
-  identity: `HIVE_SQUID_PROXY` (`services.hyperhive.squid.listen`, the bridge IP
+  identity: `HIVE_SQUID_PROXY` (`services.hyperhive.deploy.hive-controller.squid.listen`, the bridge IP
   and port) and `HIVE_EGRESS_NO_PROXY` (the direct hosts below). A hive that
   predates them writes neither, and its agents go direct.
   `hive-agent-proxy-credential.service` (`nix/agent-modules/egress-proxy.nix`)
@@ -272,7 +272,7 @@ host. It never decrypts TLS, so it holds no signing key. It caches nothing.
   has no CIDR support, so the list holds the bridge as an address.
 
 - **Two lists.** The credential decides the policy. `hive-c0re` writes a
-  second file beside the users file, `services.hyperhive.squid.unrestrictedFile`
+  second file beside the users file, `services.hyperhive.deploy.hive-controller.squid.unrestrictedFile`
   (`/var/lib/hive-squid/unrestricted`, `hive-core:squid`, `0640`): the names of
   the users whose agent holds the `unrestricted_internet` flag in the
   permissions the hive last read from the swarm, one per line, rewritten when
@@ -289,7 +289,7 @@ host. It never decrypts TLS, so it holds no signing key. It caches nothing.
   restricted. Agents must not start sending credentials until every hive runs
   the `hive-c0re` that writes it, or a legacy agent loses general internet.
 
-- **Base list.** `services.hyperhive.squid.baseAllowedDomains` is open to every
+- **Base list.** `services.hyperhive.deploy.hive-controller.squid.baseAllowedDomains` is open to every
   authenticated user, whatever its flag: what the agent harness needs off the
   swarm. The default is the hosts Claude Code requires
   (<https://code.claude.com/docs/en/network-config>): `api.anthropic.com` for
@@ -300,8 +300,8 @@ host. It never decrypts TLS, so it holds no signing key. It caches nothing.
   agent's own swarm entries (see _Swarm allow-list_ below). The list omits the plugin marketplace clone from `github.com`, since a failed add
   isn't fatal. The rules below still refuse an entry that resolves to a
   private address.
-- **Allow-list.** `services.hyperhive.squid.allowedDomains` defaults to empty,
-  plus the self-check canary (`services.hyperhive.squid.selfcheck.canary`), so
+- **Allow-list.** `services.hyperhive.deploy.hive-controller.squid.allowedDomains` defaults to empty,
+  plus the self-check canary (`services.hyperhive.deploy.hive-controller.squid.selfcheck.canary`), so
   the canary widens the restricted list by that one name. The swarm's own
   service names aren't on it: they resolve to the bridge or a private address,
   which the rules below refuse, and agents reach them directly. Each entry
@@ -313,8 +313,8 @@ host. It never decrypts TLS, so it holds no signing key. It caches nothing.
   ([allowed domains](../swarm/ui.md#allowed-domains)); the swarm controller
   keeps them in one value of the `egress-allow` bucket, each for every agent
   or for one agent. Every 30 seconds `hive-c0re` reads it and writes two files
-  beside the users file, `services.hyperhive.squid.allowedFile`
-  (`/var/lib/hive-squid/allowed`) and `services.hyperhive.squid.agentAllowFile`
+  beside the users file, `services.hyperhive.deploy.hive-controller.squid.allowedFile`
+  (`/var/lib/hive-squid/allowed`) and `services.hyperhive.deploy.hive-controller.squid.agentAllowFile`
   (`/var/lib/hive-squid/agent-allow.conf`), `hive-core:squid`, `0640`, and
   logs `squid allow list: 2 swarm, 3 agent entries` when they change. The
   swarm-wide names join the allow ACL, so a restricted user reaches them. A
@@ -387,12 +387,12 @@ host. It never decrypts TLS, so it holds no signing key. It caches nothing.
   client's source address.
 - **Self-check.** `squid-selfcheck.timer` runs `squid-selfcheck.service`
   every minute from the bridge IP, logging in as `selfcheck.squid`: `CONNECT`
-  to `services.hyperhive.squid.selfcheck.canary` (default: `cache.nixos.org`,
+  to `services.hyperhive.deploy.hive-controller.squid.selfcheck.canary` (default: `cache.nixos.org`,
   a public name that's also on the allow-list)
   must answer 200, to `deny-canary.invalid` 403, and to the canary without a
   credential 407. It then logs in as `selfcheck-unrestricted.squid`, which has
   the same secret and is always on the unrestricted list, and a `CONNECT` to
-  `services.hyperhive.squid.selfcheck.unrestrictedCanary` (default:
+  `services.hyperhive.deploy.hive-controller.squid.selfcheck.unrestrictedCanary` (default:
   `example.com`, a name outside the allow-list) must answer 200. It writes one
   `squid-selfcheck ok=… allow_status=… deny_status=… anon_status=…
 credential=present|absent unrestricted_canary=… unrestricted_status=…` line