feat(3088): move the gateway's nginx + dnsmasq onto the host

The gateway's nginx + dnsmasq no longer run in their own nspawn container.
`nix/host-modules/hive-gateway/default.nix` loses the
`containers.hive-gateway` wrapper and everything that existed only to punch
holes in it: `privateNetwork = false`, `CAP_NET_ADMIN`, five bind mounts,
its own `stateVersion`, `networking.firewall.enable = false`,
`networking.resolvconf.enable = false`, and the `hive-gateway-resolv`
path+service pair. 465 -> 303 lines.

The container never bought isolation here. It shared the host netns by
necessity — nginx binds the host's :80/:443, dnsmasq answers on the bridge —
so each of those settings was undoing a boundary the gateway could not
afford in the first place.

Four things made it more than a deletion, none of them visible in the nix
diff:

- The self-signed cert service also imports the hive CA leaf, so removing it
  with the container would have left nginx naming a missing cert file, which
  it refuses to load at all.
- The nginx reload is a hive-priv verb. It still needs root, but no longer
  for the reason its doc gave, and `--machine=` was both transport and
  scope — so the unit name is now hard-coded in the helper as the
  containment.
- The lifecycle verb named a container that stops existing.
- `journalctl -M hive-gateway` had no machine to enter.

Per the operator's ruling, the operator verb keeps working and agents lose
it. `InfraContainer` answered three questions that used to share an answer;
it now splits into `name()` (identity), `target()` (Container vs HostUnit),
`service_unit()` (the systemd unit), and `agent_restartable()`, which the
MCP restart path checks before the capability so the refusal cannot read as
"ask for infra_admin". `SIBLING_CONTAINERS` drops the gateway — it gates the
requests that name a container as a string — while `FromStr` still accepts
it, because that answers what a name is, not who may act on it. The
dashboard's gateway journal reads host journald filtered to `nginx.service`.

Prose was corrected where it only named a location, and re-argued where the
container was doing security work: a `0666` per-agent socket was safe
because only the gateway container had the directory bind-mounted. There is
no mount now, so the directory permissions are the whole of the access
control — the constraint holds, its mechanism doesn't.

Gate: nix fmt / clippy --all-targets -D warnings / cargo test all clean (710
tests); hivectl-cli.md regenerated from the clap tree. The nix eval was run
in both TLS shapes at this commit: every delta in the rendered
virtualHosts is one of the three intended path moves, dnsmasq settings are
byte-identical, and the absence probe flips true -> false with bindMounts
emptied.

docs/security.md

@@ -187,8 +187,20 @@ bind-mount compatibility with user namespace UID mapping and is tracked as a TOD
 
 `hive-c0re` runs as the unprivileged system user `hive-core`
 (`/var/lib/hyperhive` owned by `hive-core:hive-core`). It cannot
-directly invoke `nixos-container`, `journalctl -M`, or `systemctl
--M hive-gateway` — those require root. `hive-priv` fills this gap.
+directly invoke `nixos-container`, `journalctl -M`, or act on a system
+unit (`systemctl reload nginx`) — those require root. `hive-priv` fills
+this gap.
+
+⚠️ **Note what that costs when a helper verb loses its namespace.**
+`ReloadGatewayNginx` used to run `systemctl -M hive-gateway …`, and the
+`--machine=` flag was doing two jobs: it was the *transport* into the
+container **and** the *scope* — the verb could not reach anything
+outside that one machine. With nginx on the host the transport is
+unnecessary and the scope went with it, so the containment is now the
+hard-coded unit name in `hive-priv`: a caller cannot name the unit, so
+the verb cannot be steered at another service. **When a privileged verb
+stops needing a namespace, check whether the namespace was also what
+bounded it.**
 
 ### hive-priv
 
@@ -207,7 +219,7 @@ known operations; there is no arbitrary command pass-through:
 | `DestroyContainer`                                   | `nixos-container destroy <name>`                                                          |
 | `ListContainers`                                     | `nixos-container list`                                                                    |
 | `ReadContainerJournal`                               | `journalctl -M <container> -n <n> [filters...]`                                           |
-| `ReloadGatewayNginx`                                 | `systemctl -M hive-gateway reload/start/reset-failed nginx`                               |
+| `ReloadGatewayNginx`                                 | `systemctl reload/start/reset-failed nginx` (host unit; the unit name is hard-coded, not a parameter) |
 | `WriteNspawnFlags`                                   | write `/etc/nixos-containers/<container>.conf` (bind-mount list + network isolation vars) |
 | `WriteResourceLimits`                                | write `CPUQuota=`/`MemoryMax=`/`CPUWeight=`/`IOWeight=` systemd drop-in for agent container |
 | `RemoveServiceDropin`                                | remove `container@<name>.service.d/` drop-in on destroy                                   |