lifecycle: drop manager port special case (#753) — manager hashes into 8100..8999 like every other agent

nix/modules/hive-c0re.nix

@@ -239,9 +239,11 @@ in
     ];
 
     # Per-container web UIs share the host's network namespace and need
-    # their ports reachable when there's no gateway in front. Manager:
-    # 8000. Sub-agents: 8100..8999 (deterministic hash; see
-    # `lifecycle::agent_web_port`).
+    # their ports reachable when there's no gateway in front. Every
+    # container — including the manager (#753 dropped the pre-#753
+    # "manager pinned at 8000" special case) — hashes into
+    # 8100..8999 via `lifecycle::agent_web_port`'s FNV-1a, so a single
+    # range opening covers all of them.
     #
     # The dashboard port (`cfg.dashboardPort`, default 7000) is *not*
     # listed here — since #652 the dashboard binds `127.0.0.1` only,
@@ -257,11 +259,8 @@ in
     # open in the host firewall would defeat the gateway's "single
     # front door" story (closes #621). Operators who opt out of the
     # gateway still get those direct ports opened so the legacy
-    # `http://<host>:8100/` flow works.
+    # `http://<host>:<port>/` flow works.
     networking.firewall = lib.mkIf (!config.services.hyperhive.gateway.enable) {
-      allowedTCPPorts = [
-        8000
-      ];
       allowedTCPPortRanges = [
         {
           from = 8100;

nix/modules/hive-forge.nix

@@ -42,8 +42,8 @@ in
       default = 3000;
       description = ''
         TCP port the forge serves HTTP on. Default 3000 sits outside
-        hyperhive's claimed ranges (dashboard 7000, manager 8000,
-        sub-agents 8100..8999). Change this if you already have
+        hyperhive's claimed ranges (dashboard 7000, every agent in
+        8100..8999 via FNV-1a hash). Change this if you already have
         another forgejo bound to 3000.
       '';
     };

nix/modules/hive-matrix.nix

@@ -246,8 +246,8 @@ in
       description = ''
         TCP port tuwunel serves the matrix client-server API on.
         Default 8008 is the matrix-spec well-known port. Sits
-        outside hyperhive's claimed ranges (dashboard 7000, manager
-        8000, sub-agents 8100..8999). Federation listens on
+        outside hyperhive's claimed ranges (dashboard 7000, every
+        agent in 8100..8999 via FNV-1a hash). Federation listens on
         `federationPort` separately.
       '';
     };