nix/matrix+gateway: server_name defaults to hive domain + .well-known routes (#660)

mara on #660: "Matrix domain should default to hive domain if not
set otherwise / redirect matrix clients with .well-known"

Two coupled changes:

1. `services.hyperhive.matrix.serverName` default flipped from
   `matrix.${services.hyperhive.domain}` (subdomain) to just
   `${services.hyperhive.domain}` (bare hive domain).

   This is a "for new deploys only" change — `server_name` is
   embedded irrevocably in every user/room ID, so existing
   homeservers must set `serverName` explicitly to preserve the
   subdomain shape if that's where their identifiers were minted.
   Description updated to point at the .well-known piece below.

2. `hive-gateway` nginx now serves matrix-spec `.well-known`
   auto-discovery JSON at the canonical location when matrix is
   enabled + hive domain set:

       GET /.well-known/matrix/client
           {"m.homeserver":{"base_url":"http://<domain>:<httpPort>"}}
           + Access-Control-Allow-Origin: *  (per matrix spec)

       GET /.well-known/matrix/server
           {"m.server":"<domain>:<httpPort>"}

   tuwunel serves both client + federation on the same `httpPort`
   (see hive-matrix.nix), so both records point at the same
   endpoint. No-op when matrix isn't enabled or hive domain isn't
   set — nothing to advertise.

Combined effect: with `services.hyperhive.domain = "darkest.space"` +
matrix enabled, a matrix client pointed at `darkest.space` resolves
through `.well-known` to the actual `:8008` endpoint, no subdomain
needed. MXIDs become `@atlas:darkest.space` (was: `@atlas:matrix.darkest.space`).

Verified via `nix eval`:
- server_name = "darkest.space" (was "matrix.darkest.space")
- gateway locations include `= /.well-known/matrix/client` + `= /.well-known/matrix/server`
- well-known/matrix/client returns the spec-shaped JSON

Caveat: `m.homeserver.base_url` advertises HTTP (no TLS yet —
follow-up). matrix clients increasingly require HTTPS for new
account creation, so the v0 setup works for local-network testing
but won't satisfy public clients until the gateway TLS story lands.

Closes #660.

nix/modules/hive-matrix.nix

@@ -7,8 +7,7 @@
 let
   cfg = config.services.hyperhive.matrix;
   hyperhiveDomain = config.services.hyperhive.domain;
-  effectiveServerName =
-    if cfg.serverName != null then cfg.serverName else "matrix.${hyperhiveDomain}";
+  effectiveServerName = if cfg.serverName != null then cfg.serverName else hyperhiveDomain;
 in
 {
   # Private Matrix homeserver (matrix-tuwunel — the official conduwuit
@@ -77,10 +76,14 @@ in
         (`@argus:<server_name>`) and room ID minted on this
         homeserver. CRITICAL: must be stable from day one because
         it's embedded irrevocably in the identifiers. Defaults to
-        `matrix.''${services.hyperhive.domain}` (always a subdomain — keeps
-        the root domain free for the dashboard or forge). Override
-        here only if you need a name that doesn't follow the
-        `matrix.<domain>` shape.
+        `services.hyperhive.domain` (the bare hive domain — per mara
+        on #660). Combined with the `.well-known/matrix/{client,server}`
+        routes the hive-gateway serves at that domain (also #660),
+        clients auto-discover the actual matrix endpoint without
+        needing a subdomain. Override here only if you need a
+        different server_name shape (e.g. `matrix.<domain>` if you
+        want the subdomain split, or `chat.example.org` for a
+        bespoke hostname).
       '';
     };