feat(#1867): make the internal forge mandatory (remove forge.enable)

The internal forge is the canonical store for the meta flake, every
agent's config repo, and the internal/* repos, so it can no longer be
optional. Remove the services.hyperhive.forge.enable toggle:

- hive-forge.nix: drop the `enable` option; the forge config now
  deploys gated on `services.hyperhive.enable` (it ships with hyperhive).
- hive-c0re.nix: HIVE_FORGE_URL env unconditional; forge-public-URL gate
  drops the enable check (keeps behindGateway).
- hive-gateway.nix: local /etc/hosts forge entry keyed on behindGateway.
- hive-ci.nix: drop the now-moot `forge.ci.enable requires forge.enable`
  assertion (forge is always present); reword the option doc.
- nix/docs/default.nix: drop the `forge.enable = mkForce false` stub
  (option gone); the options-doc eval stays light via hyperhive.enable.
- hive-c0re forge.rs / hivectl.rs: reword 'forge.enable = true' error
  text to 'wait for hive-c0re to start the container' (the runtime
  token-absent path is unchanged — it's a bootstrap-timing check, not
  the opt-out).
- docs/approvals.md, docs/ci.md: drop stale forge.enable references.

Migration: configs that set `services.hyperhive.forge.enable = false`
must drop the line — the forge is now mandatory.

Prereq/companion to #1838 (PR-based config flow, which assumes the forge
is always present).

nix/modules/hive-c0re.nix

@@ -109,11 +109,11 @@ let
     if stylixThemeColors != null then themedFrontend stylixThemeColors else cfg.frontend;
 in
 {
-  # The forge is part of the standard install — hive-c0re mirrors
-  # every agent's applied config repo into it. On by default; opt out
-  # with `services.hyperhive.forge.enable = false`. hive-matrix is
-  # opt-in (off by default) and asserts that `services.hyperhive.domain`
-  # is set before it can be enabled.
+  # The forge is mandatory — hive-c0re mirrors every agent's applied
+  # config repo into it and it's the canonical store for the meta flake
+  # + `internal/*` repos, so there's no enable toggle; it deploys with
+  # hyperhive itself. hive-matrix is opt-in (off by default) and asserts
+  # that `services.hyperhive.domain` is set before it can be enabled.
   imports = [
     ./hive-ci.nix
     ./hive-forge.nix
@@ -790,10 +790,11 @@ in
       // lib.optionalAttrs (config.services.hyperhive.swarmName != null) {
         HYPERHIVE_SWARM_NAME = config.services.hyperhive.swarmName;
       }
-      // lib.optionalAttrs config.services.hyperhive.forge.enable {
+      // {
         # In-cluster forge URL — the gateway vhost (`forge.<domain>`), which
-        # nginx proxies to forgejo. Set directly: this env only exists when
-        # hyperhive is enabled. See `docs/gateway.md::HIVE_FORGE_URL`.
+        # nginx proxies to forgejo. The forge is mandatory, so this is
+        # unconditional (the whole env block is already gated on hyperhive
+        # being enabled). See `docs/gateway.md::HIVE_FORGE_URL`.
         HIVE_FORGE_URL = "http://${config.services.hyperhive.forge.domain}";
       }
       // lib.optionalAttrs config.services.hyperhive.matrix.enable {
@@ -823,19 +824,16 @@ in
         # dashboard doesn't need to learn the gateway is unconditional.
         HIVE_GATEWAY_ENABLED = "1";
       }
-      //
-        lib.optionalAttrs
-          (config.services.hyperhive.forge.enable && config.services.hyperhive.forge.behindGateway)
-          {
-            # Public URL of the forge vhost served by hive-gateway. The
-            # dashboard uses this to build browser-facing forge links
-            # instead of hardcoding `<hostname>:3000`, which breaks when
-            # the operator accesses the dashboard through the gateway
-            # (forge sub-domain has no port; direct port URL would be
-            # wrong). Absent when `behindGateway = false` — dashboard
-            # falls back to `<hostname>:3000`.
-            HIVE_FORGE_PUBLIC_URL = "https://${config.services.hyperhive.forge.domain}";
-          }
+      // lib.optionalAttrs config.services.hyperhive.forge.behindGateway {
+        # Public URL of the forge vhost served by hive-gateway. The
+        # dashboard uses this to build browser-facing forge links
+        # instead of hardcoding `<hostname>:3000`, which breaks when
+        # the operator accesses the dashboard through the gateway
+        # (forge sub-domain has no port; direct port URL would be
+        # wrong). Absent when `behindGateway = false` — dashboard
+        # falls back to `<hostname>:3000`.
+        HIVE_FORGE_PUBLIC_URL = "https://${config.services.hyperhive.forge.domain}";
+      }
       // lib.optionalAttrs (config.services.hyperhive.swarm.peers != { }) {
         # Peer hives serialised as a JSON array of {domain, cert_fingerprint,
         # wireguard_address?} objects. Consumed by hive-ag3nt::identity::peers()