nix: finish the current-behaviour comment sweep in touched files

Rewrite the remaining narration in files the previous commit touched:
"moved"/"sat"/"was REMOVED"/"old default" comments in swarm-bao,
swarm-otel, glue-bao-tls, nats-authelia, swarm-controller, swarm-ui,
swarm-otel-service, swarm-authelia-service, the deploy.nix rename table,
hive-ci, hive-forge/service, hive-tls, hyperhive, swarm-nats, swarm.nix
and a few module-eval fixtures, so each says where a thing is or why it
is so now.

Revert the comment edits inside shell script strings in hive-tls,
swarm-nats and the forge token mint to their previous text, so those
generated units are unchanged. The only unit still changing is
swarm-bao-pki (two comment lines in its script). Refs #3902

nix/host-modules/swarm-nats.nix

@@ -118,14 +118,13 @@ let
       # Two accounts, and the callout user lives in neither of the accounts
       # it authorizes into.
       accounts = {
-        # ⚠️ The nkey is not decoration and its absence was a real hole: a
+        # ⚠️ The nkey is not decoration, and without it there is a hole: a
         # `users` entry carrying only a `user` name has no credential, and
         # `CONNECT {"user":"auth"}` is then accepted with no password at
         # all. Since the name is a literal in this public module, that made
         # the callout-exempt identity walk-in-able from every container on
         # the shared netns — the same class of hole this module exists to
-        # close, moved rather than fixed. Caught in review on the first
-        # version of this file. An nkey and NOTHING else, both halves
+        # close. An nkey and NOTHING else, both halves
         # measured against a running server rather than reasoned about:
         #
         #   { user = "auth"; }               → `CONNECT {"user":"auth"}`