dashboard: hide forge links instead of guessing <hostname>:3000

Adds services.hyperhive.forge.publicUrl (defaults to the gateway vhost
URL when behindGateway=true, null otherwise). HIVE_FORGE_PUBLIC_URL is
now sourced from it instead of hardcoding https://${forge.domain}
whenever behindGateway is on.

The 4 frontend call sites that built a forge link from
state.forge_public_url now hide the link when that's absent, rather
than guessing http://<browser-hostname>:3000 — a guess that's only
correct by accident once the operator isn't on plain localhost. Fixes
the dashboard H0M3 tile, per-agent-row forge links + agent menu, the
approval-queue PR link, and the per-agent page's own meta-nav forge
link (found during this pass, same defect, not in the original
3-site inventory).

Docs + doc-comments updated to match.

hive-agent/src/web_ui/state.rs

@@ -153,11 +153,12 @@ pub(super) struct StateSnapshot {
     /// — single source of truth. See [`docs/web-ui/dashboard.md::Container row`]
     /// for the frontend resolver + which links appear in which conditions.
     links: Vec<AgentLink>,
-    /// Public URL of the forge served by hive-gateway (e.g.
+    /// Public URL of the forge (e.g.
     /// `"https://forge.pr1ma.darkest.space"`). Sourced from
-    /// `HIVE_FORGE_PUBLIC_URL`; `None` when `forge.behindGateway=false`
-    /// or the env var is absent. The frontend uses this to build forge
-    /// nav-strip links instead of hardcoding `<hostname>:3000`.
+    /// `HIVE_FORGE_PUBLIC_URL` (set from `services.hyperhive.forge.
+    /// publicUrl`); `None` when unset. The frontend uses this to build
+    /// forge nav-strip links, and **hides** the forge link entirely
+    /// when absent rather than guessing `<hostname>:3000`.
     forge_public_url: Option<String>,
     /// Human name of this hive instance (e.g. `"pr1ma"`). Sourced
     /// from `HYPERHIVE_HIVE_NAME`; `None` when unset. The frontend