hive-gateway: no hive-domain vhost on a host without a hive

The hive-domain vhost renders only where a hive runs. On a host without
one the only certificate is the swarm-services leaf, which does not name
the hive domain, so a homeserver host without a hive serves matrix on the
homeserver's own name only; apex matrix discovery is #4878.

Comments and test names describe the code's current behaviour.

Refs #4588

docs/networking/gateway.md

@@ -21,14 +21,14 @@ You rarely switch it on yourself. `gateway.enable` defaults to off, and every mo
 | `chat.<swarm>/config.json` | inline JSON (FluffyChat boot config) | `hive-matrix.nix`, `swarm.matrix.gatewayHost != null` |
 | `grafana.<swarm>`, `metrics.<swarm>`, `logs.<swarm>`, `otel.<swarm>`, `bao.<swarm>` | the matching swarm service | that service's module → [`swarm/services.md`](../swarm/services.md) |
 
-**The hive domain's own vhost**, named for the hive domain. It renders where a hive runs (`deploy.hive-controller.enable`) or the homeserver does (`deploy.matrix.enable`); on a host with neither there is no such vhost. On a host without a hive only the two matrix rows exist:
+**The hive's own vhost**, named for the hive domain. It exists only on a host that runs a hive (`deploy.hive-controller.enable`); a host without a hive has none of these rows:
 
 | URL | upstream | when |
 | --- | --- | --- |
-| `<hive>/` | dashboard dist (static, from `servedFrontend`) | `deploy.hive-controller.enable` |
-| `<hive>/api/`, `/health/` | hive-c0re (`7000`) | `deploy.hive-controller.enable` |
-| `<hive>/api/docs/` | themed Swagger UI dist (static) | `deploy.hive-controller.enable` |
-| `<hive>/agent/<name>/` | per-agent harness over its unix socket | `deploy.hive-controller.enable`; `agents.conf` (runtime-generated) |
+| `<hive>/` | dashboard dist (static, from `servedFrontend`) | always |
+| `<hive>/api/`, `/health/` | hive-c0re (`7000`) | always |
+| `<hive>/api/docs/` | themed Swagger UI dist (static) | always |
+| `<hive>/agent/<name>/` | per-agent harness over its unix socket | `agents.conf` (runtime-generated) |
 | `<hive>/.well-known/matrix/{client,server}` | inline JSON | `deploy.matrix.enable` |
 | `<hive>/matrix/` | 301 → `chat.<swarm>/` | `deploy.matrix.enable` and `gatewayHost` set |
 
@@ -86,7 +86,7 @@ The issuer is the **secret store's `pki` mount**, not a bare self-signed leaf. `
 
 **Cert shape**: the leaf's CN is the bare hive domain; its SANs are `<hive>` and `*.<hive>`. The hive's role allows nothing outside `<hive>`, so a swarm-service name can't go on this leaf. Those names get the swarm-services leaf instead ([`swarm/ca.md`](../swarm/ca.md)).
 
-**Rotation**: `hive-tls-resign.service` runs at boot, on every deploy and once a day, and asks the store for a new leaf when the current one is missing, past half its 720-hour lifetime, no longer covers the configured names, doesn't match its key, or doesn't chain to the store's root. A leaf already on disk lets the gateway start while the store can't answer; a failed renewal leaves it in place. To force a rotation, delete `gateway.pem` under the state dir and restart the unit; it re-imports the leaf and reloads `nginx` itself.
+**Rotation**: `hive-tls-resign.service` runs at boot, on every deploy and once a day, and asks the store for a new leaf when the current one is missing, past half its 720-hour lifetime, doesn't cover the configured names, doesn't match its key, or doesn't chain to the store's root. A leaf already on disk lets the gateway start while the store can't answer; a failed renewal leaves it in place. To force a rotation, delete `gateway.pem` under the state dir and restart the unit; it re-imports the leaf and reloads `nginx` itself.
 
 **Cert prompts**: browsers warn once per host until you add the hive's `trust-bundle.pem` (the anchor, not the leaf) to the browser or OS trust store. A container that needs to trust it for its own outbound TLS gets the bundle a different way, bind-mounted read-only at `/run/hive-ca/trust-bundle.pem` (`nix/host-modules/lib/hive-ca-trust.nix`).
 

docs/swarm/ca.md

@@ -65,9 +65,8 @@ self-signed root a consumer already holds in its trust bundle.
 
 **A gateway host that runs no hive** (`deploy.hive-controller.enable` off,
 such as a dedicated swarm-services or secret-store host) has no hive leaf, no
-`hive-tls-resign.service`, no hive identity and no dashboard or agent routes;
-its hive-domain vhost exists only to serve matrix discovery where the
-homeserver runs there. Its gateway serves the swarm-services leaf as its default certificate too. Where it
+`hive-tls-resign.service`, no hive identity and no hive-domain vhost. Its
+gateway serves the swarm-services leaf as its default certificate too. Where it
 fronts other swarm names it waits for `swarm-services-cert.service` at start.
 Where the store's UI is its only swarm name it starts on a throwaway
 self-signed certificate and switches to the services leaf once the store