hive-matrix: run the homeserver in its own netns, behind a unix socket

tuwunel bound `0.0.0.0:<httpPort>` in the host netns, so the homeserver
port was open on every host address, and the gateway proxied to it on
host loopback.

The container now sets `privateNetwork = true` and hangs off the hive
bridge with a DHCP lease, the same attach the CI runner, builder and
review classifier use (resolvconf on, `networking.nameservers` the bridge
IP). tuwunel listens only on `/run/hive-matrix/tuwunel.sock`, a host
directory (root:nginx 0770) bind-mounted into the container; its primary
group is nginx's gid and the socket is 0660. The gateway's `/_matrix/`
location proxies to the socket.

The static resolv.conf goes: it existed because resolvconf's host
tracking came up empty in the shared netns.

`swarm.matrix.httpPort` and `{swarm,deploy}.matrix.openFirewall` are
removed with a message: there is no host port to choose or open. The
`.well-known/matrix/*` fallback to `<hive>:<httpPort>` is dropped with
them; it only rendered with `gatewayHost = null`, which the homeserver's
SSO assertion already rejects.

Part of #4815.

nix/module-eval/bao-controller.nix

@@ -57,8 +57,8 @@ let
     swarm.matrix.gatewayHost = "matrix.hive.t.local";
   };
 
-  # No matrix vhost for this swarm at all: tuwunel stays direct on
-  # `httpPort`, so there is no homeserver URL to hand the controller.
+  # No matrix vhost for this swarm at all, so there is no homeserver URL
+  # to hand the controller.
   controllerNoGatewayHost = hive {
     deploy.swarm-controller.enable = true;
     swarm.matrix.gatewayHost = null;