gateway: $connection_upgrade does not come from recommendedProxySettings

The doc comment on PROXY_HEADER_BLOCK attributed the variable to
`recommendedProxySettings = true`. It does not: nixpkgs' nginx module
emits `map $http_upgrade $connection_upgrade` into commonHttpConfig
outside that conditional, after four other independently-gated blocks.

The distinction is load-bearing rather than pedantic, because several
hyperhive vhosts set `recommendedProxySettings = false` per location
(hive-forge's auth_request endpoint, swarm-ui, swarm-victorialogs,
swarm-victoriametrics). Under the old comment, moving the per-agent
include near any of them reads as breaking the websocket headers, and
the fix someone would reach for is a second, redundant map in our own
http config.

Verified against the nixpkgs module rather than inferred: the
recommendedProxySettings block opens and closes ten lines before the
map, and `git grep connection_upgrade -- nix/` returns nothing, so
nothing on our side defines it either.

hive-c0re/src/gateway_nginx.rs

@@ -42,11 +42,13 @@ fn health() -> &'static Mutex<SweepHealth> {
 }
 
 /// Nginx proxy headers present in every per-agent location block.
-/// `$connection_upgrade` is defined in the http context by the NixOS
+/// `$connection_upgrade` is an http-context variable the NixOS nginx
-/// nginx module when `recommendedProxySettings = true` (which the
+/// module emits unconditionally (`map $http_upgrade $connection_upgrade`
-/// gateway always sets). `X-Forwarded-Prefix` is per-location (set
+/// in `commonHttpConfig`); it does not depend on
-/// below in the render loop). Kept as a standalone const so it's
+/// `recommendedProxySettings`, which several hyperhive vhosts turn off
-/// visible to tests without repeating the text.
+/// per location. `X-Forwarded-Prefix` is per-location (set below in the
+/// render loop). Kept as a standalone const so it's visible to tests
+/// without repeating the text.
 const PROXY_HEADER_BLOCK: &str = "    proxy_http_version 1.1;
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection $connection_upgrade;