feat(3088): move the gateway's nginx + dnsmasq onto the host

The gateway's nginx + dnsmasq no longer run in their own nspawn container.
`nix/host-modules/hive-gateway/default.nix` loses the
`containers.hive-gateway` wrapper and everything that existed only to punch
holes in it: `privateNetwork = false`, `CAP_NET_ADMIN`, five bind mounts,
its own `stateVersion`, `networking.firewall.enable = false`,
`networking.resolvconf.enable = false`, and the `hive-gateway-resolv`
path+service pair. 465 -> 303 lines.

The container never bought isolation here. It shared the host netns by
necessity — nginx binds the host's :80/:443, dnsmasq answers on the bridge —
so each of those settings was undoing a boundary the gateway could not
afford in the first place.

Four things made it more than a deletion, none of them visible in the nix
diff:

- The self-signed cert service also imports the hive CA leaf, so removing it
  with the container would have left nginx naming a missing cert file, which
  it refuses to load at all.
- The nginx reload is a hive-priv verb. It still needs root, but no longer
  for the reason its doc gave, and `--machine=` was both transport and
  scope — so the unit name is now hard-coded in the helper as the
  containment.
- The lifecycle verb named a container that stops existing.
- `journalctl -M hive-gateway` had no machine to enter.

Per the operator's ruling, the operator verb keeps working and agents lose
it. `InfraContainer` answered three questions that used to share an answer;
it now splits into `name()` (identity), `target()` (Container vs HostUnit),
`service_unit()` (the systemd unit), and `agent_restartable()`, which the
MCP restart path checks before the capability so the refusal cannot read as
"ask for infra_admin". `SIBLING_CONTAINERS` drops the gateway — it gates the
requests that name a container as a string — while `FromStr` still accepts
it, because that answers what a name is, not who may act on it. The
dashboard's gateway journal reads host journald filtered to `nginx.service`.

Prose was corrected where it only named a location, and re-argued where the
container was doing security work: a `0666` per-agent socket was safe
because only the gateway container had the directory bind-mounted. There is
no mount now, so the directory permissions are the whole of the access
control — the constraint holds, its mechanism doesn't.

Gate: nix fmt / clippy --all-targets -D warnings / cargo test all clean (710
tests); hivectl-cli.md regenerated from the clap tree. The nix eval was run
in both TLS shapes at this commit: every delta in the rendered
virtualHosts is one of the three intended path moves, dnsmasq settings are
byte-identical, and the absence probe flips true -> false with bindMounts
emptied.

docs/tools/hivectl-cli.md

@@ -808,7 +808,7 @@ Bare `hivectl stop` stops everything; scope flags narrow it to specific sub-agen
 * `--agent <NAME>` — A specific sub-agent by name. Repeatable: `--agent a --agent b`
 * `--ci` — The CI runner container (`hive-ci`)
 * `--forge` — The forge container (`hive-forge`)
-* `--gateway` — The gateway container (`hive-gateway`)
+* `--gateway` — The gateway (`hive-gateway`) — nginx on the host, not a container
 * `--matrix` — The matrix container (`hive-matrix`)
 * `--graceful` — Gracefully quiesce each agent before stopping, instead of a hard stop. Each agent gets a graceful-stop DAG on the job queue: the harness is signalled, runs one stop-checkpoint turn to flush durable `/state`, drains, then the container is stopped (bounded by a 3-min timeout that falls back to a hard stop). All drains overlap. Applies to agents only
 * `--no-wait` — Return immediately after the stop DAGs are queued instead of waiting for them with live per-node progress
@@ -829,7 +829,7 @@ Bare `hivectl start` restores the agents stopped by the last broad-scope `stop`
 * `--agent <NAME>` — A specific sub-agent by name. Repeatable: `--agent a --agent b`
 * `--ci` — The CI runner container (`hive-ci`)
 * `--forge` — The forge container (`hive-forge`)
-* `--gateway` — The gateway container (`hive-gateway`)
+* `--gateway` — The gateway (`hive-gateway`) — nginx on the host, not a container
 * `--matrix` — The matrix container (`hive-matrix`)
 * `--no-wait` — Return immediately after the start DAGs are queued instead of waiting for them with live per-node progress
 
@@ -849,7 +849,7 @@ Bare `hivectl restart` restarts everything; scope flags narrow it.
 * `--agent <NAME>` — A specific sub-agent by name. Repeatable: `--agent a --agent b`
 * `--ci` — The CI runner container (`hive-ci`)
 * `--forge` — The forge container (`hive-forge`)
-* `--gateway` — The gateway container (`hive-gateway`)
+* `--gateway` — The gateway (`hive-gateway`) — nginx on the host, not a container
 * `--matrix` — The matrix container (`hive-matrix`)
 * `--graceful` — Gracefully quiesce each agent on the stop half (see `stop --graceful`). Applies to agents only
 

docs/tools/scheduling.md

@@ -79,8 +79,10 @@ lifecycle events, or another container's boot log.
 - `unit` — filter to a systemd unit (e.g. `hive-c0re.service`).
 - `container` — nspawn machine name verbatim. Agent containers use
   the `h-<name>` prefix (e.g. `h-iris`); infrastructure containers
-  use their full name (e.g. `hive-ci`, `hive-forge`, `hive-matrix`,
-  `hive-gateway`). Omit for the host journal.
+  use their full name (e.g. `hive-ci`, `hive-forge`, `hive-matrix`).
+  Omit for the host journal. The gateway has no machine — its nginx
+  runs on the host, so read it with `unit: nginx.service` and no
+  `container`.
 - `lines` — how many lines to return (default 30, max 100).
 - `priority` — minimum syslog level (`emerg` … `debug`).
 - `grep` — regex matched against log message fields (`journalctl --grep`).