feat(nix): derive the hive domain from a new swarm.domain

Every hive in a swarm occupies its own sub-domain of the swarm's, so
the hive domain is derivable rather than something each hive restates.
`services.hyperhive.swarm.domain` is new and nullable; the hive's own
`domain` keeps its existing required-ness and its existing assertion,
and gains a default of `<hiveName>.<swarm.domain>`.

Deliberately a default and not a rename: an alias would reinterpret the
domains hives have already deployed, while a default only fills in the
ones that never set one. Same reason there is no new assertion — the
existing message just names the derivation, so this adds a way to stop
failing rather than a way to fail.

nix/host-modules/hive-network.nix

@@ -161,7 +161,10 @@ in
             hive resolver is authoritative for `<hive-domain>` and its
             sub-domains, and agents reach the forge/matrix through the
             gateway by that domain. Pin a hostname
-            (`services.hyperhive.domain = "example.com";`).
+            (`services.hyperhive.domain = "example.com";`), or set
+            `services.hyperhive.swarm.domain` and
+            `services.hyperhive.hiveName` and it is derived for you as
+            `<hiveName>.<swarm.domain>`.
           '';
         }
       ];