docs(matrix): fix stale matrix.<hive> vhost + assertion-list claims

Verified against nix/host-modules/hive-matrix.nix: gatewayHost's current
default is chat.<swarm-domain>, not matrix.<hive>, so the GUI mount point
and fluffychat client line were stale. Also rewrote the Assertion
rationale section, which named an assertion (hyperhiveDomain/serverName)
that doesn't exist in this module and missed the three SSO assertions
that do.

docs/matrix.md

@@ -2,7 +2,7 @@
 
 Private Matrix homeserver (matrix-tuwunel — the conduwuit
 successor) wrapped in a nixos-container, plus optional fluffychat-web
-client at `matrix.<hive>/`. Configured via
+client at `chat.<swarm-domain>/` (the `gatewayHost` vhost). Configured via
 `services.hyperhive.swarm.matrix.*`; vhost routing lives in
 [`gateway.md`](gateway.md).
 
@@ -208,18 +208,28 @@ resource-constrained hosts where a 20 MB request is unexpectedly large.
 
 ## Assertion rationale
 
-Two `config.assertions` entries fail eval early rather than ship
+`config.assertions` in this module fail eval early rather than ship
 surprising behaviour:
 
-- **`hyperhiveDomain != null || cfg.serverName != null`** —
-  `server_name` is embedded into every user / room ID irrevocably;
-  we refuse to spawn the homeserver with a bogus `server_name` we
-  can never change later.
 - **`cfg.gatewayHost != ""`** — same footgun as `forge.domain`:
   empty string renders `.<hive>`-shaped garbage in both nginx
   `server_name` (treated as wildcard catch-all, surprising) and
   `/etc/hosts` (invalid entry). `null` is the right opt-out shape;
   empty string is rejected explicitly.
+- **`sso.enable` requires `sso.clientSecretFile`** — fails at eval,
+  not at boot: tuwunel reads its identity providers from the config
+  file, so a half-configured one can stop the homeserver from
+  starting outright rather than merely hiding a login button.
+- **`sso.enable` requires `swarm.authelia.url`** — without a
+  provider URL there is nothing to discover against.
+- **`sso.enable` requires `gatewayHost != null`** — the SSO callback
+  URL is format-locked to `<homeserver>/_matrix/client/unstable/login/sso/callback/<client_id>`,
+  and the identity provider needs a public name to redirect the
+  browser to.
+
+`server_name`'s own bogus-value guard lives in `hive-network.nix`
+(`services.hyperhive.domain != null`), not here — see
+[`docs/network.md`](network.md).
 
 ## fluffychat-web build fixes
 
@@ -265,5 +275,5 @@ Two non-obvious details worth knowing before touching either derivation:
 Drop both derivations when nixpkgs's flutter builder grows worker
 + emcc support upstream.
 
-Mount point is `matrix.<hive>/`; upstream `--base-href "/"` is
-correct at sub-domain root, no override.
+Mount point is `chat.<swarm-domain>/` (the `gatewayHost` vhost);
+upstream `--base-href "/"` is correct at sub-domain root, no override.