fix(#2860): no loopback default for the matrix homeserver

Third and last of #2860's agent-facing URL fallbacks. The operator's
ruling was "any special casing is done on the nix side - same binaries,
no hard coded fallback", so the default is deleted rather than replaced.

Every layer guessed the same wrong thing, and each guess was only ever
correct for a process sharing the host netns:

- nix/agent-modules/matrix.nix: matrixUrlDefault = localhost:8008, both
  as the option's default and as a sentinel the daemon unit compared
  against to decide whether to write HIVE_MATRIX_URL. Now nullOr str,
  default null, the guard is != null, and the doc says what forge.url's
  already says: null means "no matrix", not "guess one".
- nix/host-modules/hive-c0re/environment.nix: forwarded
  http://127.0.0.1:<port> when no gatewayHost was set. hive-c0re shares
  the host netns so it reads as harmless, but the value is handed to
  agents, which do not -- there it names the agent itself. Now forwarded
  only when there is a gateway vhost to name, matching the guard
  HIVE_MATRIX_PUBLIC_URL already uses twelve lines below.
- hive-matrix-mcp: paths::DEFAULT_HOMESERVER was the same address
  compiled in, so dropping the nix defaults alone would have left the
  daemon dialling loopback inside the agent's own netns -- the very bug,
  one layer down. homeserver_url() is now Option, and an account with no
  homeserver is skipped with a log, exactly as one with no token is.
  discover_token_accounts already refused to guess for the same reason.

Two comments taught the assumption back to the next reader ("shared host
netns means every agent container resolves localhost to the same
machine"); both now say which side of the netns boundary they describe.
MATRIX_HTTP keeps its value -- hive-c0re really does share the host
netns -- but no longer claims agents do.

Gated with nix eval against the extended agent-base config, as a pair:
with no url set the daemon unit carries no HIVE_MATRIX_URL, and with one
set it carries exactly that. Either check alone passes on a broken guard.

docs/turn-loop/config.md

@@ -132,7 +132,7 @@ setups.
 
 ```nix
 hyperhive.forge.url = "http://forge.example:3000";  # default: null
-hyperhive.matrix.url = "http://localhost:8008";     # default
+hyperhive.matrix.url = "https://matrix.example";    # default: null
 ```
 
 **`hyperhive.forge.url`** — base URL of the Forgejo instance. Used by
@@ -155,12 +155,22 @@ flake without one, so `null` only survives where the agent modules are
 evaluated outside a hive.
 
 **`hyperhive.matrix.url`** — homeserver URL used by
-`hive-matrix-daemon` when connecting via the matrix-sdk. Default
-(`localhost:8008`) is overridden by hive-c0re at deploy time to the
-gateway-routed `matrix.<domain>` URL so isolated agents can reach the
-homeserver. Override per-agent when an agent should talk to a
-different homeserver — for example a remote hive's tuwunel reached
-over a VPN, or an external Matrix server for a federation-only agent.
+`hive-matrix-daemon` when connecting via the matrix-sdk. hive-c0re
+writes it into every agent at deploy time as the gateway-routed
+`matrix.<domain>` URL, so isolated agents can reach the homeserver.
+Override per-agent when an agent should talk to a different homeserver
+— for example a remote hive's tuwunel reached over a VPN, or an
+external Matrix server for a federation-only agent.
+
+**Defaults to `null`, meaning "no matrix" — for the same reason
+`forge.url` does.** The homeserver may live on another host, and a
+loopback default resolves inside the agent's own netns to the agent,
+so it would be a value that evaluates fine and then talks to the wrong
+machine. With `null` the daemon has no homeserver and no-ops exactly as
+it does without a token. The hive only forwards `HIVE_MATRIX_URL` when
+it actually has a matrix vhost to name, so `null` survives where a hive
+runs no homeserver, or where the agent modules are evaluated outside a
+hive.
 
 ## Claude Code plugins