feat(gateway): htpasswd Basic auth — close #1010

Replaces the earlier PAM+binary approach with nginx's built-in
`auth_basic` module. No new binary, no new systemd service, no PAM.

New option `services.hyperhive.gateway.auth`:
- `enable` — off by default
- `htpasswdFile` — host path to an htpasswd file (required when enable)
- `realm` — WWW-Authenticate realm string (default "hyperhive");
  restricted to `strMatching "[^\"$]*"` to prevent nginx config injection

When enabled:
- the parent directory of `htpasswdFile` is bind-mounted read-only
  into the gateway container at `/run/gateway-auth/`
- the `"/"` proxy location gets `auth_basic` + `auth_basic_user_file`

Create credentials: `htpasswd -Bc /path/to/file alice` (BCrypt).
See `docs/gateway.md` ("HTTP Basic auth") for the full setup guide.

hive-c0re/Cargo.toml

@@ -12,8 +12,6 @@ base64.workspace = true
 reqwest.workspace = true
 clap.workspace = true
 hive-sh4re.workspace = true
-libc = "0.2"
-pam.workspace = true
 listenfd = "1"
 rusqlite.workspace = true
 serde.workspace = true