grafana: make socketDir readOnly and drop its rename alias

The socket's directory is its access control, so it has to stay dedicated
to Grafana's one socket. Nothing in the tree sets the option; making it
read-only turns "point it at a shared directory" into an eval error
instead of a convention.

A rename shim contributes a definition to its target, which a read-only
option refuses, so the swarm.grafana.socketDir alias goes with it. The
module-eval fixture no longer sets the old path; a new case asserts that
defining the option fails evaluation and that the default reaches nginx.

nix/host-modules/deploy.nix

@@ -50,10 +50,6 @@ in
       [ "services" "hyperhive" "swarm" "grafana" "enable" ]
       [ "services" "hyperhive" "deploy" "grafana" "enable" ]
     )
-    (lib.mkRenamedOptionModule
-      [ "services" "hyperhive" "swarm" "grafana" "socketDir" ]
-      [ "services" "hyperhive" "deploy" "grafana" "socketDir" ]
-    )
     (lib.mkRenamedOptionModule
       [ "services" "hyperhive" "swarm" "grafana" "datasourceUrl" ]
       [ "services" "hyperhive" "deploy" "grafana" "datasourceUrl" ]
@@ -110,15 +106,19 @@ in
       [ "services" "hyperhive" "swarm" "authelia" "usersFile" ]
       [ "services" "hyperhive" "deploy" "authelia" "usersFile" ]
     )
-    # `hostClientSecretDir` and `hostUsersFile` deliberately have NO entry
-    # here. A rename module contributes a
-    # *definition* to its target, and both are `readOnly`, which refuses a
-    # second one — so a shim for either makes every evaluation fail with
+    # `hostClientSecretDir`, `hostUsersFile` and `grafana.socketDir`
+    # deliberately have NO entry here. A rename module contributes a
+    # *definition* to its target, and all three are `readOnly`, which refuses a
+    # second one — so a shim for any of them makes every evaluation fail with
     # "set multiple times", naming the option's own default as the rival
-    # definition. Nothing could have set them anyway: both are derived and
-    # read-only, so the shim's only possible customer is a reader of the old
-    # path, and that reader now gets "option does not exist" instead, which
-    # says the same thing sooner.
+    # definition.
+    #
+    # The first two are derived, so nothing could ever have set them and a
+    # shim's only customer is a reader of the old path. `grafana.socketDir` was
+    # a plain settable option; only a test fixture set it in
+    # this tree, but a deployment outside it can have. That setter now fails
+    # evaluation with "option does not exist" at the old path, rather than
+    # being carried to the new one.
     (lib.mkRenamedOptionModule
       [ "services" "hyperhive" "swarm" "nats" "enable" ]
       [ "services" "hyperhive" "deploy" "nats" "enable" ]

nix/host-modules/swarm-grafana.nix

@@ -291,10 +291,15 @@ in
     socketDir = lib.mkOption {
       type = lib.types.str;
       default = "/run/swarm-grafana";
+      readOnly = true;
       description = ''
         Directory holding the unix socket Grafana serves on, shared between
         the host (where nginx runs) and the container (where Grafana runs).
 
+        Fixed, not configurable: the directory's mode is what keeps the socket
+        private, so it has to be dedicated to this one socket, and a settable
+        path could be pointed at a directory that carries something else.
+
         ⚠️ **Grafana takes no TCP port at all, and that is the point.** Every
         swarm service container shares the host's network namespace, so a
         port is a swarm-wide resource that two modules can silently both

nix/module-eval/grafana.nix

@@ -23,13 +23,20 @@ let
 
   grafanaOldPath = hive {
     deploy.grafana.enable = true;
-    swarm.grafana.socketDir = "/run/test-grafana-sock";
     swarm.grafana.datasourceUrl = "http://127.0.0.1:19999";
     swarm.grafana.logsDatasourceUrl = "http://127.0.0.1:19998";
     swarm.grafana.plugins = [ ];
     swarm.grafana.package = pkgs.emptyDirectory;
   };
 
+  # A host that tries to move the socket directory; reading the option throws.
+  grafanaSocketDirSet = hive {
+    deploy.grafana.enable = true;
+    deploy.grafana.socketDir = "/run/test-grafana-sock";
+    deploy.grafana.plugins = [ ];
+    deploy.grafana.package = pkgs.emptyDirectory;
+  };
+
   # Same pairing `nix/module-eval/bao-otel-collector.nix` uses for its own
   # cases: the store's container with its own collector on, so
   # `.containers.swarm-bao.config` carries a real, evaluated
@@ -101,6 +108,18 @@ let
       && lib.hasInfix option a.message
     ) m.assertions;
   cases = [
+    {
+      # The socket's directory is its access control, so it must stay dedicated
+      # to this one socket. `readOnly` is what makes that inexpressible: a
+      # definition anywhere — here at the `deploy` path — has to fail the eval,
+      # and an unset host has to render the default into nginx's upstream.
+      name = "grafana's socket directory cannot be set and renders its default";
+      ok =
+        !(builtins.tryEval grafanaSocketDirSet.services.hyperhive.deploy.grafana.socketDir).success
+        &&
+          grafanaOldPath.services.nginx.virtualHosts."grafana-metrics".locations."= /metrics".proxyPass
+          == "http://unix:/run/swarm-grafana/grafana.sock:/metrics";
+    }
     {
       # This fixture enables grafana and NOT authelia, so the login-form toggle
       # has to follow "grafana requires SSO" rather than "both services are on