feat(3167): options + certificate name for the swarm UI

New swarm-ui module: enable (derived from swarm.controller.enable - the
UI reads that daemon's state over its socket, so the host that runs the
controller is the host that can serve the UI), domain (defaults to the
swarm apex; an option so a hive can pin it like forge/matrix can), and
package.

Adds the name to swarm.serviceDomains, which is both the services
sub-CA's nameConstraints set and the leaf's SAN set. The apex is a
SIBLING of forge./chat./auth., not a parent, so nothing issues for it
implicitly - left out, the vhost falls back to the hive leaf and the
swarm's front page opens with a name mismatch.

Asserts the UI domain differs from the hive domain: the gateway's
default server already answers for the latter, and two vhosts claiming
one server_name resolve to whichever nginx picks rather than erroring.

nix/host-modules/default.nix

@@ -26,6 +26,7 @@
     ./swarm-ca.nix
     ./swarm-controller.nix
     ./swarm-snapshot-store.nix
+    ./swarm-ui.nix
     ./swarm-wireguard.nix
     ./swarm.nix
     ./swarm-peers-removed.nix