module-eval: move a stranded comment back to the case it describes

Four lines about "no store here, so no bind mount and no unit" sat
above the swarm-ui case, which they have nothing to do with. The case
they describe -- a bootstrap token on a host that runs no store -- had
no comment at all, so this is a move rather than a deletion.

Reworded on the way, because it opened with "the arm that makes the one
above mean something". A comment that names a POSITION retargets when
the file is reordered, which is how it came loose in the first place;
it now names the granting-unit cases.

Noticed while adding a case directly above it, which opened with the
same sentence.

nix/module-eval.nix

@@ -546,10 +546,6 @@ let
         && !(lib.hasInfix "client-ca.pem" s);
     }
     {
-      # The arm that makes the one above mean something, and the property the
-      # host-side half depends on: no store here, so no bind mount and no unit.
-      # Without it a hive that merely names a token would drag the store's
-      # container config into its evaluation.
       # Reads the vhost's rendered `root`, not the option: the UI is served
       # straight out of a store path, so a shim that resolves but stops
       # reaching the module would leave nginx pointing at the default build.
@@ -587,6 +583,10 @@ let
           == pkgs.emptyDirectory;
     }
     {
+      # What makes the granting-unit cases mean something, and the property
+      # the host-side half depends on: no store here, so no bind mount and no
+      # unit. Without it a hive that merely names a token would drag the
+      # store's container config into its evaluation.
       name = "a bootstrap token on a host that runs no store grants nothing";
       ok = !(baoGrantNoStore.systemd.services ? swarm-bao-bootstrap-dir);
     }