chore(docs,nix): fix stale 'localhost via shared netns' claims in forge/matrix

Agents in private netns can't reach host loopback directly; they
use forge.<domain> and matrix.<domain> via the gateway. Update four
locations that still claimed direct loopback access:

- hive-forge.nix: module header + openFirewall description
- hive-matrix.nix: openFirewall description
- docs/matrix.md: container design bullet + openFirewall section

nix/modules/hive-matrix.nix

@@ -173,12 +173,12 @@ in
       example = true;
       description = ''
         Open `httpPort` in the host firewall. Off by default
-        (secure-by-default): the homeserver is reachable from the
-        host + every agent container via `localhost` either way
-        (shared netns), so the firewall open only matters for access
-        from outside the host. Flip to `true` when announcing the
-        homeserver to other hives or when an external matrix client
-        needs to reach the client-server API directly.
+        (secure-by-default): the host reaches the homeserver on
+        loopback, and agent containers reach it at `matrix.<domain>`
+        via the gateway — so the firewall open only matters for
+        access from outside the host. Flip to `true` when announcing
+        the homeserver to other hives or when an external matrix
+        client needs to reach the client-server API directly.
 
         **Breaking change**: this used to default to `true`. If you
         relied on the old default for external reach, add