dashboard: hide forge links instead of guessing <hostname>:3000

Adds services.hyperhive.forge.publicUrl (defaults to the gateway vhost
URL when behindGateway=true, null otherwise). HIVE_FORGE_PUBLIC_URL is
now sourced from it instead of hardcoding https://${forge.domain}
whenever behindGateway is on.

The 4 frontend call sites that built a forge link from
state.forge_public_url now hide the link when that's absent, rather
than guessing http://<browser-hostname>:3000 — a guess that's only
correct by accident once the operator isn't on plain localhost. Fixes
the dashboard H0M3 tile, per-agent-row forge links + agent menu, the
approval-queue PR link, and the per-agent page's own meta-nav forge
link (found during this pass, same defect, not in the original
3-site inventory).

Docs + doc-comments updated to match.

nix/host-modules/hive-forge/default.nix

@@ -130,6 +130,37 @@ in
       '';
     };
 
+    publicUrl = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default =
+        if config.services.hyperhive.enable && cfg.behindGateway then "https://${cfg.domain}" else null;
+      defaultText = lib.literalExpression ''
+        if behindGateway then "https://''${domain}" else null
+      '';
+      example = "https://forge.example.com";
+      description = ''
+        Browser-facing forge URL the dashboard uses to build clickable
+        forge links (the H0M3 Forge tile, per-agent-row forge links,
+        the approval-queue's "review PR on forge" link) — sourced into
+        every agent container + hive-c0re as `HIVE_FORGE_PUBLIC_URL`.
+
+        Defaults to `https://''${cfg.domain}` when `behindGateway =
+        true` (the gateway vhost is genuinely reachable at that URL)
+        and `null` otherwise. When `null`, the dashboard **hides**
+        forge links rather than guessing one — see
+        `docs/web-ui/dashboard.md::H0M3 page` for the rationale (a
+        link built from the operator's own browser hostname + a
+        container port is only an accident away from wrong on any
+        deployment that isn't plain localhost).
+
+        **Set this explicitly if `behindGateway = false`** and the
+        forge is still reachable at a stable URL you want linked from
+        the dashboard (e.g. `http://<lan-host>:''${toString cfg.httpPort}`
+        for an all-LAN deployment) — leaving it unset there means the
+        dashboard's forge links are simply absent, not broken.
+      '';
+    };
+
     package = lib.mkOption {
       type = lib.types.package;
       default = pkgs.forgejo;