feat(gateway): hivectl gateway user management + fix htpasswdFile assertion

Add `hivectl gateway {create-user,delete-user,list-users}` subcommands for
managing htpasswd files used by gateway Basic auth. Pure Rust bcrypt
(cost 12, $2y$ prefix nginx accepts). No external htpasswd binary required.

Also fix the NixOS module assertion: `cfg.auth ? htpasswdFile` is always
true in the module system (declared options always exist as keys); switch
to `nullOr path; default = null` + `!= null` check so the assertion
actually fires with a useful error when enable=true but no file is set.
Guard bind-mount and nginx config against null to prevent eval errors.

Update docs/gateway.md to show hivectl commands instead of raw htpasswd.

hive-ag3nt/src/forge_notify.rs

@@ -244,10 +244,7 @@ fn is_username_byte(b: u8) -> bool {
 /// window so addressed agents never silently miss a mention on a long
 /// body. See `docs/forge.md::Body excerpt + truncation + heading
 /// escape` for the truncate-before-escape ordering rule.
-fn extract_truncated_mention_lines<'a>(
-    full_body: &'a str,
-    included_excerpt: &str,
-) -> Vec<&'a str> {
+fn extract_truncated_mention_lines<'a>(full_body: &'a str, included_excerpt: &str) -> Vec<&'a str> {
     full_body
         .lines()
         .filter(|line| {
@@ -914,7 +911,10 @@ mod tests {
         let full = "# @argus check this\nmore body\n";
         let raw_excerpt = full; // fits entirely
         let lines = extract_truncated_mention_lines(full, raw_excerpt);
-        assert!(lines.is_empty(), "heading+mention inside window must not be re-surfaced, got {lines:?}");
+        assert!(
+            lines.is_empty(),
+            "heading+mention inside window must not be re-surfaced, got {lines:?}"
+        );
     }
 
     #[test]