dashboard: hide forge links instead of guessing <hostname>:3000

Adds services.hyperhive.forge.publicUrl (defaults to the gateway vhost
URL when behindGateway=true, null otherwise). HIVE_FORGE_PUBLIC_URL is
now sourced from it instead of hardcoding https://${forge.domain}
whenever behindGateway is on.

The 4 frontend call sites that built a forge link from
state.forge_public_url now hide the link when that's absent, rather
than guessing http://<browser-hostname>:3000 — a guess that's only
correct by accident once the operator isn't on plain localhost. Fixes
the dashboard H0M3 tile, per-agent-row forge links + agent menu, the
approval-queue PR link, and the per-agent page's own meta-nav forge
link (found during this pass, same defect, not in the original
3-site inventory).

Docs + doc-comments updated to match.

frontend/packages/dashboard/src/call.js

@@ -242,12 +242,10 @@ export function renderApprovals() {
   }
   // forge link base — only when the hive-forge container is up.
   const fs = window.__hyperhive_state;
-  const hostname = (fs && fs.hostname) || window.location.hostname;
-  // Prefer state.forge_public_url (set when forge.behindGateway=true,
-  // e.g. "https://forge.pr1ma.darkest.space") over the direct :3000 port.
-  const forgeBase = (fs && fs.forge_present)
-    ? (fs.forge_public_url || `http://${hostname}:3000`)
-    : null;
+  // state.forge_public_url (set from services.hyperhive.forge.publicUrl)
+  // or null — never guessed from "<hostname>:3000". The PR-link builder
+  // below already gates on forgeBase being truthy.
+  const forgeBase = (fs && fs.forge_present && fs.forge_public_url) || null;
 
   const ul = el('ul', { class: 'approvals' });
   for (const a of pending) {