feat(gateway): hivectl gateway user management + fix htpasswdFile assertion

Add `hivectl gateway {create-user,delete-user,list-users}` subcommands for
managing htpasswd files used by gateway Basic auth. Pure Rust bcrypt
(cost 12, $2y$ prefix nginx accepts). No external htpasswd binary required.

Also fix the NixOS module assertion: `cfg.auth ? htpasswdFile` is always
true in the module system (declared options always exist as keys); switch
to `nullOr path; default = null` + `!= null` check so the assertion
actually fires with a useful error when enable=true but no file is set.
Guard bind-mount and nginx config against null to prevent eval errors.

Update docs/gateway.md to show hivectl commands instead of raw htpasswd.

hive-ag3nt/src/stats.rs

@@ -391,7 +391,11 @@ fn summarize_durations(all: &mut [i64]) -> DurationSummary {
     }
 }
 
-#[allow(clippy::cast_precision_loss, clippy::cast_possible_truncation, clippy::cast_sign_loss)]
+#[allow(
+    clippy::cast_precision_loss,
+    clippy::cast_possible_truncation,
+    clippy::cast_sign_loss
+)]
 fn percentile(sorted: &[i64], pct: u8) -> f64 {
     if sorted.is_empty() {
         return 0.0;
@@ -471,7 +475,15 @@ mod tests {
                     (started_at, ended_at, duration_ms, model, wake_from,
                      last_input_tokens, tool_call_breakdown_json, result_kind)
                  VALUES (?1, ?2, ?3, ?4, ?5, 1000, ?6, ?7)",
-                params![started, started + dur / 1000, dur, model, wake, tools_json, result],
+                params![
+                    started,
+                    started + dur / 1000,
+                    dur,
+                    model,
+                    wake,
+                    tools_json,
+                    result
+                ],
             )
             .unwrap();
         }
@@ -485,7 +497,14 @@ mod tests {
         seed_db(
             &db,
             &[
-                (now - 600, 5_000, "opus", "recv", "ok", r#"{"Read":2,"Bash":1}"#),
+                (
+                    now - 600,
+                    5_000,
+                    "opus",
+                    "recv",
+                    "ok",
+                    r#"{"Read":2,"Bash":1}"#,
+                ),
                 (now - 300, 10_000, "opus", "recv", "ok", r#"{"Read":3}"#),
                 (now - 100, 20_000, "sonnet", "operator", "failed", "{}"),
             ],