nix: run swarm-ui wherever swarm-controller runs

Remove deploy.swarm-ui.enable. Every reader (the swarm-ui vhost, the
authelia operator rule for the swarm apex, hive-network's
anyServiceEnabled) now reads deploy.swarm-controller.enable, and the
controller's webhook public URL is gated on the swarm domain alone,
since the vhost it names exists wherever the daemon does.

Both spellings of the old switch (deploy.swarm-ui.enable and the
already-renamed swarm.ui.enable) become mkRemovedOptionModule entries,
so a host that still sets either fails evaluation with a message
naming the controller toggle instead of silently changing.

Ruling (mara, #3742): "swarm-ui always runs wherever controller runs".

Part of #3742

nix/host-modules/hive-forge/default.nix

@@ -623,7 +623,7 @@ in
               # swarm's host was the missing one, and every swarm-controller
               # delivery was refused for it.
               #
-              # Not gated on `deploy.swarm-ui.enable`: in a spread deployment the
+              # Not gated on `deploy.swarm-controller.enable`: in a spread deployment the
               # forge and the swarm host are different machines, so that
               # per-host flag is false exactly where this entry is needed.
               webhook.ALLOWED_HOST_LIST = lib.concatStringsSep "," (