feat(#1867): make the internal forge mandatory (remove forge.enable)

The internal forge is the canonical store for the meta flake, every
agent's config repo, and the internal/* repos, so it can no longer be
optional. Remove the services.hyperhive.forge.enable toggle:

- hive-forge.nix: drop the `enable` option; the forge config now
  deploys gated on `services.hyperhive.enable` (it ships with hyperhive).
- hive-c0re.nix: HIVE_FORGE_URL env unconditional; forge-public-URL gate
  drops the enable check (keeps behindGateway).
- hive-gateway.nix: local /etc/hosts forge entry keyed on behindGateway.
- hive-ci.nix: drop the now-moot `forge.ci.enable requires forge.enable`
  assertion (forge is always present); reword the option doc.
- nix/docs/default.nix: drop the `forge.enable = mkForce false` stub
  (option gone); the options-doc eval stays light via hyperhive.enable.
- hive-c0re forge.rs / hivectl.rs: reword 'forge.enable = true' error
  text to 'wait for hive-c0re to start the container' (the runtime
  token-absent path is unchanged — it's a bootstrap-timing check, not
  the opt-out).
- docs/approvals.md, docs/ci.md: drop stale forge.enable references.

Migration: configs that set `services.hyperhive.forge.enable = false`
must drop the line — the forge is now mandatory.

Prereq/companion to #1838 (PR-based config flow, which assumes the forge
is always present).

nix/modules/hive-forge.nix

@@ -41,19 +41,11 @@ in
   # `/var/lib/nixos-containers/hive-forge/var/lib/forgejo/` survives
   # restart. See `docs/gateway.md::hive-forge container shape`.
 
+  # The internal forge is mandatory — it's the canonical store for the
+  # meta flake + every agent's config repo (and the `internal/*` repos),
+  # so there is no enable/disable toggle. It deploys whenever hyperhive
+  # itself is enabled (`services.hyperhive.enable`).
   options.services.hyperhive.forge = {
-    enable = lib.mkOption {
-      type = lib.types.bool;
-      default = true;
-      description = ''
-        Run hive-forge — a private Forgejo (in a nixos-container) for
-        hyperhive agents. On by default: hive-c0re mirrors every
-        agent's applied config repo into the forge's `agent-configs`
-        org, so the forge is part of the standard install. Set
-        `services.hyperhive.forge.enable = false` to opt out.
-      '';
-    };
-
     httpPort = lib.mkOption {
       type = lib.types.port;
       default = 3000;
@@ -192,7 +184,7 @@ in
     };
   };
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.services.hyperhive.enable {
     assertions = [
       {
         assertion = cfg.rootUrl == null || lib.hasSuffix "/" cfg.rootUrl;