fix(systemd): set explicit SyslogIdentifier on hyperhive-declared units

Follow-up to the harness fix: any unit whose ExecStart is a generated
wrapper (a NixOS `script =` block or a writeShellScript) gets its journal
SyslogIdentifier derived from the wrapper's store-path basename — an
opaque, unstable name. Pin an explicit stable identifier on every unit
hyperhive declares.

script/wrapper units (leaked store paths): forgejo-gpg-init,
hive-gateway-self-signed-cert, hive-tls-ca, hive-ci-prefetch,
hyperhive-isolated-dns, tea-login, forge-avatar-sync,
matrix-avatar-sync, hive-dashboard-links.

direct-binary units (basename already sane; explicit for tidiness +
future-proofing): hive-c0re, hive-priv, hive-matrix-daemon,
hive-bash-daemon, weston.

Only changes the displayed line identifier; journalctl -u <unit>
filtering (keys on _SYSTEMD_UNIT) is unaffected.

nix/modules/hive-gateway.nix

@@ -830,6 +830,8 @@ in
             serviceConfig = {
               Type = "oneshot";
               RemainAfterExit = true;
+              # Pin the journal identity (else it's the `script` store-path wrapper).
+              SyslogIdentifier = "hive-gateway-self-signed-cert";
             };
             path = [ pkgs.coreutils ];
             script = ''