forge: move the forgejo package to deploy — slice 10 complete

The last of the twelve. `swarm.forge.package` becomes
`deploy.forgejo.package`, beside the `behindGateway` / `mirrors` /
host-secret options that were already there.

⚠️ `deploy.forgejo`, not `deploy.forge`. The forge joins the controller
and the UI as a mover where the two sides simply do not share a name,
so the shim comment says which one.

Four readers, and one of them is why an anchored grep was the wrong
instrument: `:678` reads `cfg.package.data`, a sub-attribute, which
`cfg.package}` and `cfg.package/` both miss.

Three copies of the same sentence claimed the package stays under
`swarm.forge` — `deploy.nix`, this module's own `deploy.forgejo`
header, and `docs/integrations/forge.md`. The docs one is outside
`nix/` entirely. A namespace split gets described wherever the split is
explained, which is not only where the option is declared.

`forgeOldPath` gains the old path, and its comment's count of the
host-side options goes five → six with it.

docs/integrations/forge.md

@@ -3,9 +3,10 @@
 Private Forgejo instance running in a nixos-container, used as the
 swarm's persistent code-collaboration surface (issues, PRs, reviews,
 attachments). Configured via `services.hyperhive.swarm.forge.*` (what the
-forge IS to every hive — its package, names, ports, URLs) plus
+forge IS to every hive — names, ports, URLs) plus
 `services.hyperhive.deploy.forgejo.*` (what the host running it decides —
-how it's served, what it mirrors, where its host-local secrets sit).
+which build it runs, how it's served, what it mirrors, where its
+host-local secrets sit).
 Container
 shape, ROOT_URL / sub-domain routing, and operator-vs-in-cluster URL
 handling live in [`docs/networking/gateway.md`](../networking/gateway.md); this file owns the