fix: route gateway nginx control through hive-priv

systemctl --machine=hive-gateway requires root (machine-bus transport
enters the container namespace). hive-c0re is unprivileged, so every
call to nginx_active_state() and gateway_systemctl() silently failed
with exit 1, causing a continuous 30s retry loop without ever
syncing nginx.

Fix:
- Move state-aware nginx logic into hive-priv ReloadGatewayNginx:
  check ActiveState, then reload/reset-start/start accordingly.
  hive-priv already runs as root and has machine-bus rights.
- Remove nginx_active_state() and gateway_systemctl() from
  gateway_nginx.rs (they were always running unprivileged, always
  failing silently).
- Make write(), reload_if_pending(), reload_gateway_nginx() async so
  they can call the async priv_client without a blocking bridge.
- Update callers in agent_sockets::spawn_poll and meta::sync_agents
  to await the now-async functions.

The priv_client::reload_gateway_nginx() call and PrivRequest::ReloadGatewayNginx
wire type already existed — the gateway_nginx module was just not using them.

hive-c0re/src/meta.rs

@@ -126,13 +126,11 @@ pub async fn sync_agents(hive: &HiveEnv, agents: &[AgentSpec]) -> Result<()> {
         tracing::warn!(error = ?e, "agent_sockets::write failed (non-fatal)");
     }
 
-    // Refresh /var/lib/hyperhive/agents.conf — the nginx include file
-    // the gateway picks up at runtime without needing a
-    // nixos-rebuild. The gateway container bind-mounts
-    // /var/lib/hyperhive/ and a systemd path unit fires
-    // `nginx -s reload` when this file changes. Same
-    // best-effort + non-fatal shape.
-    if let Err(e) = crate::gateway_nginx::write(&agent_names) {
+    // Refresh /var/lib/hyperhive/gateway/agents.conf — the nginx include
+    // file the gateway container bind-mounts and nginx reads at runtime.
+    // c0re triggers a reload (or start) inside hive-gateway via hive-priv
+    // after writing the file. Same best-effort + non-fatal shape.
+    if let Err(e) = crate::gateway_nginx::write(&agent_names).await {
         tracing::warn!(error = ?e, "gateway_nginx::write failed (non-fatal)");
     }