lifecycle: drop manager port special case (#753) — manager hashes into 8100..8999 like every other agent

nix/modules/hive-c0re.nix

@@ -239,9 +239,11 @@ in
     ];
 
     # Per-container web UIs share the host's network namespace and need
-    # their ports reachable when there's no gateway in front. Manager:
-    # 8000. Sub-agents: 8100..8999 (deterministic hash; see
-    # `lifecycle::agent_web_port`).
+    # their ports reachable when there's no gateway in front. Every
+    # container — including the manager (#753 dropped the pre-#753
+    # "manager pinned at 8000" special case) — hashes into
+    # 8100..8999 via `lifecycle::agent_web_port`'s FNV-1a, so a single
+    # range opening covers all of them.
     #
     # The dashboard port (`cfg.dashboardPort`, default 7000) is *not*
     # listed here — since #652 the dashboard binds `127.0.0.1` only,
@@ -257,11 +259,8 @@ in
     # open in the host firewall would defeat the gateway's "single
     # front door" story (closes #621). Operators who opt out of the
     # gateway still get those direct ports opened so the legacy
-    # `http://<host>:8100/` flow works.
+    # `http://<host>:<port>/` flow works.
     networking.firewall = lib.mkIf (!config.services.hyperhive.gateway.enable) {
-      allowedTCPPorts = [
-        8000
-      ];
       allowedTCPPortRanges = [
         {
           from = 8100;