deploy: move the hive CA's knobs to deploy.hive-controller.tls

`services.hyperhive.tls.{stateDir,caValidityDays,leafValidityDays}` sat at
the top of `services.hyperhive`, which is meant to be everything about
hyperhive rather than the settings of one hive. Where the hive CA lives,
how long it lasts and how long the leaves it signs last are decisions of
the host holding the key — `deploy.*`, by the same rule as the switches
that moved before them.

`hive-controller` is hive-c0re's new name (mara on the issue), so the
knobs hang off the daemon that owns the CA rather than off a bare `tls`
at the root. mkRenamedOptionModule entries carry existing configs.

⚠️ Unlike the two switch renames, these names are NOT unique, so this was
swept by ALIAS BINDING rather than by identifier: hive-tls.nix alone holds
two options spelled `stateDir` — its own `cfg.stateDir` and the swarm CA's
`swarmCaCfg.stateDir`, four sites that must not move. Nine files bind an
alias to this config; the rename followed those bindings.

Two sites were invisible to the obvious check, and an unanchored sweep for
`hyperhive\.tls\b` is what found them: the option declaration (`= {` after
the path, so no trailing `.` or `;`) and the alias convention documented in
a comment in lib/hive-ca-trust.nix.

Also renamed the `<tls.stateDir>` shorthand in four docs and two Rust doc
comments, anchored on its delimiters — the new path contains the old one
as a substring, so an unanchored replace would have doubled the prefix.

nix/host-modules/swarm-ca.nix

@@ -81,10 +81,10 @@ in
 
         With it off, both artifacts are operator-provided: the root
         under `stateDir`, and this hive's CA under
-        `services.hyperhive.tls.stateDir`. A hive given neither keeps
-        the self-signed CA it has always had — it simply isn't part of
-        a swarm's trust hierarchy, which is the correct outcome for a
-        hive nobody has federated yet.
+        `services.hyperhive.deploy.hive-controller.tls.stateDir`. A hive
+        given neither keeps the self-signed CA it has always had — it
+        simply isn't part of a swarm's trust hierarchy, which is the
+        correct outcome for a hive nobody has federated yet.
       '';
     };
 
@@ -126,7 +126,7 @@ in
       default = 10950;
       description = ''
         Validity window of the swarm root CA in days (default ~30y).
-        Deliberately longer than `services.hyperhive.tls.caValidityDays`:
+        Deliberately longer than `services.hyperhive.deploy.hive-controller.tls.caValidityDays`:
         the root must outlive the hive CAs it issues, or those chains
         expire out from under hives that are still perfectly happy with
         their own intermediate. Rotating a root is the one operation in