nix/docs: extract CSS into sibling file (#625)

Per mara on #622 comment 7442:
> follow up moving scripts and css and stuff out of the nix file.
> can live in the same dir.

Layout:

    nix/docs/
      default.nix   ← what was nix/docs.nix
      style.css     ← extracted from inline `styleCSS = '' ... ''`

`builtins.readFile ./style.css` loads the stylesheet at evaluation
time, so the rendered HTML stays byte-identical (CSS inlined into
each page's `<style>` block — verified). Future client-side scripts
can land at `nix/docs/script.js` with the same `builtins.readFile`
pattern.

Bonus: the docs.nix stub NixOS eval was still force-disabling
`hyperhive.{forge,matrix}.enable` on the pre-#615 namespace; updated
to `services.hyperhive.{forge,matrix}.enable` so `nix flake check`
passes against current main. (Same fix lives on PRs #619 + #620;
whichever lands first wins, the others rebase to a no-op.)

`flake.nix` references updated: `./nix/docs.nix` → `./nix/docs`.

Verified:
- `nix flake check --no-build` passes clean
- `nix build .#docs` produces 5-file bundle identical to pre-PR shape
- inline CSS still appears 3× per HTML page (one per index/host/agent)

flake.nix

@@ -116,7 +116,7 @@
           ...
         }:
         let
-          docsAttrs = import ./nix/docs.nix {
+          docsAttrs = import ./nix/docs {
             inherit pkgs self;
             inherit (nixpkgs) lib;
             inherit (nixpkgs.lib) nixosSystem;
@@ -349,7 +349,7 @@
           # frontend deps. CI fails fast if a module change breaks
           # option declarations or the doc rendering. Reuses the
           # `packages.<system>.docs` derivation so the per-system eval
-          # of `nix/docs.nix` happens once.
+          # of `nix/docs/default.nix` happens once.
           inherit (self.packages.${system}) docs;
         }
       );