feat(3088): move the gateway's nginx + dnsmasq onto the host

The gateway's nginx + dnsmasq no longer run in their own nspawn container.
`nix/host-modules/hive-gateway/default.nix` loses the
`containers.hive-gateway` wrapper and everything that existed only to punch
holes in it: `privateNetwork = false`, `CAP_NET_ADMIN`, five bind mounts,
its own `stateVersion`, `networking.firewall.enable = false`,
`networking.resolvconf.enable = false`, and the `hive-gateway-resolv`
path+service pair. 465 -> 303 lines.

The container never bought isolation here. It shared the host netns by
necessity — nginx binds the host's :80/:443, dnsmasq answers on the bridge —
so each of those settings was undoing a boundary the gateway could not
afford in the first place.

Four things made it more than a deletion, none of them visible in the nix
diff:

- The self-signed cert service also imports the hive CA leaf, so removing it
  with the container would have left nginx naming a missing cert file, which
  it refuses to load at all.
- The nginx reload is a hive-priv verb. It still needs root, but no longer
  for the reason its doc gave, and `--machine=` was both transport and
  scope — so the unit name is now hard-coded in the helper as the
  containment.
- The lifecycle verb named a container that stops existing.
- `journalctl -M hive-gateway` had no machine to enter.

Per the operator's ruling, the operator verb keeps working and agents lose
it. `InfraContainer` answered three questions that used to share an answer;
it now splits into `name()` (identity), `target()` (Container vs HostUnit),
`service_unit()` (the systemd unit), and `agent_restartable()`, which the
MCP restart path checks before the capability so the refusal cannot read as
"ask for infra_admin". `SIBLING_CONTAINERS` drops the gateway — it gates the
requests that name a container as a string — while `FromStr` still accepts
it, because that answers what a name is, not who may act on it. The
dashboard's gateway journal reads host journald filtered to `nginx.service`.

Prose was corrected where it only named a location, and re-argued where the
container was doing security work: a `0666` per-agent socket was safe
because only the gateway container had the directory bind-mounted. There is
no mount now, so the directory permissions are the whole of the access
control — the constraint holds, its mechanism doesn't.

Gate: nix fmt / clippy --all-targets -D warnings / cargo test all clean (710
tests); hivectl-cli.md regenerated from the clap tree. The nix eval was run
in both TLS shapes at this commit: every delta in the rendered
virtualHosts is one of the three intended path moves, dnsmasq settings are
byte-identical, and the absence probe flips true -> false with bindMounts
emptied.

nix/host-modules/hive-gateway/vhosts.nix

@@ -241,7 +241,7 @@ let
 
   # `/agent/` catch-all 404 + the two internal error-page targets it
   # points at. Per-agent `location /agent/<name>/` blocks live in the
-  # runtime-generated `/run/hive-state/agents.conf` (included via
+  # runtime-generated `/var/lib/hyperhive/gateway/agents.conf` (included via
   # `extraConfig` on the vhost); nginx longest-prefix-match makes a
   # real `/agent/<name>/` beat this catch-all. `internal` keeps the
   # error pages reachable only through nginx's error handling.
@@ -275,7 +275,7 @@ let
   # secret (`X-Hub-Signature-256`) protects those endpoints instead.
   dashboardAuth = lib.optionalString cfg.auth.enable ''
     auth_basic "${cfg.auth.realm}";
-    auth_basic_user_file /run/hive-state/gateway.htpasswd;
+    auth_basic_user_file /var/lib/hyperhive/gateway/gateway.htpasswd;
     # `=401` keeps the status 401 so the login dialog shows; the
     # internal page explains `hivectl gateway create-user`.
     error_page 401 =401 /__hive_auth_unauthorized;
@@ -397,15 +397,14 @@ in
         };
       # Per-agent location blocks, generated at runtime by
       # hive-c0re and written to /var/lib/hyperhive/gateway/agents.conf
-      # on the host. The bind-mount at /run/hive-state/ exposes
-      # that file here. nginx parses `include` at config-load
-      # time so a reload (triggered by c0re via systemd-run
+      # on the host — the same machine nginx runs on. nginx parses
+      # `include` at config-load time so a reload (triggered by c0re
       # after each agents.conf write) picks up new or removed
       # agents without a nixos-rebuild. nginx's longest-prefix-
       # match rule ensures `/agent/<name>/` from this file beats
       # the `/agent/` catch-all above.
       extraConfig = securityHeaders + ''
-        include /run/hive-state/agents.conf;
+        include /var/lib/hyperhive/gateway/agents.conf;
       '';
     };
   }