feat(gateway): hivectl gateway user management + fix htpasswdFile assertion

Add `hivectl gateway {create-user,delete-user,list-users}` subcommands for
managing htpasswd files used by gateway Basic auth. Pure Rust bcrypt
(cost 12, $2y$ prefix nginx accepts). No external htpasswd binary required.

Also fix the NixOS module assertion: `cfg.auth ? htpasswdFile` is always
true in the module system (declared options always exist as keys); switch
to `nullOr path; default = null` + `!= null` check so the assertion
actually fires with a useful error when enable=true but no file is set.
Guard bind-mount and nginx config against null to prevent eval errors.

Update docs/gateway.md to show hivectl commands instead of raw htpasswd.

Cargo.toml

@@ -1,6 +1,13 @@
 [workspace]
 resolver = "3"
-members = ["hive-ag3nt", "hive-c0re", "hive-forge", "hive-matrix-mcp", "hive-priv", "hive-sh4re"]
+members = [
+  "hive-ag3nt",
+  "hive-c0re",
+  "hive-forge",
+  "hive-matrix-mcp",
+  "hive-priv",
+  "hive-sh4re",
+]
 
 [workspace.package]
 edition = "2024"
@@ -18,6 +25,7 @@ must_use_candidate = "allow"
 anyhow = "1"
 axum = { version = "0.8", features = ["ws"] }
 base64 = "0.22"
+bcrypt = "0.19"
 clap = { version = "4", features = ["derive"] }
 hive-sh4re = { path = "hive-sh4re" }
 tower-http = { version = "0.6", features = ["fs"] }
@@ -45,6 +53,13 @@ tokio = { version = "1", features = [
 tokio-stream = { version = "0.1", features = ["sync"] }
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
-reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
-matrix-sdk = { version = "0.14", default-features = false, features = ["rustls-tls", "sqlite", "markdown"] }
+reqwest = { version = "0.12", default-features = false, features = [
+  "json",
+  "rustls-tls",
+] }
+matrix-sdk = { version = "0.14", default-features = false, features = [
+  "rustls-tls",
+  "sqlite",
+  "markdown",
+] }
 futures-util = "0.3"