fix: route gateway nginx control through hive-priv

systemctl --machine=hive-gateway requires root (machine-bus transport
enters the container namespace). hive-c0re is unprivileged, so every
call to nginx_active_state() and gateway_systemctl() silently failed
with exit 1, causing a continuous 30s retry loop without ever
syncing nginx.

Fix:
- Move state-aware nginx logic into hive-priv ReloadGatewayNginx:
  check ActiveState, then reload/reset-start/start accordingly.
  hive-priv already runs as root and has machine-bus rights.
- Remove nginx_active_state() and gateway_systemctl() from
  gateway_nginx.rs (they were always running unprivileged, always
  failing silently).
- Make write(), reload_if_pending(), reload_gateway_nginx() async so
  they can call the async priv_client without a blocking bridge.
- Update callers in agent_sockets::spawn_poll and meta::sync_agents
  to await the now-async functions.

The priv_client::reload_gateway_nginx() call and PrivRequest::ReloadGatewayNginx
wire type already existed — the gateway_nginx module was just not using them.

hive-c0re/src/agent_sockets.rs

@@ -194,12 +194,12 @@ pub fn spawn_poll() {
                     // selection (UDS vs TCP) depends on .bound markers
                     // which change independently of topology. Write is
                     // idempotent; skips rename when nothing changed.
-                    if let Err(e) = crate::gateway_nginx::write(&names) {
+                    if let Err(e) = crate::gateway_nginx::write(&names).await {
                         tracing::debug!(error = ?e, "gateway_nginx poll write failed");
                     }
                     // Retry a pending nginx reload that failed on a
                     // previous tick (no-op if no reload is pending).
-                    crate::gateway_nginx::reload_if_pending();
+                    crate::gateway_nginx::reload_if_pending().await;
                 }
                 Err(e) => {
                     tracing::debug!(error = ?e, "agent_sockets poll: failed to list agents");