chore(docs,nix): fix stale 'localhost via shared netns' claims in forge/matrix

Agents in private netns can't reach host loopback directly; they
use forge.<domain> and matrix.<domain> via the gateway. Update four
locations that still claimed direct loopback access:

- hive-forge.nix: module header + openFirewall description
- hive-matrix.nix: openFirewall description
- docs/matrix.md: container design bullet + openFirewall section

nix/modules/hive-forge.nix

@@ -56,8 +56,8 @@ let
 in
 {
   # Private Forgejo in a `hive-forge` nixos-container, shared host
-  # netns so agents reach it on loopback. State at
-  # `/var/lib/nixos-containers/hive-forge/var/lib/forgejo/` survives
+  # netns. Agents reach it at `forge.<domain>` via the gateway. State
+  # at `/var/lib/nixos-containers/hive-forge/var/lib/forgejo/` survives
   # restart. See `docs/gateway.md::hive-forge container shape`.
 
   # The internal forge is mandatory — it's the canonical store for the