feat(gateway): hivectl gateway user management + fix htpasswdFile assertion

Add `hivectl gateway {create-user,delete-user,list-users}` subcommands for
managing htpasswd files used by gateway Basic auth. Pure Rust bcrypt
(cost 12, $2y$ prefix nginx accepts). No external htpasswd binary required.

Also fix the NixOS module assertion: `cfg.auth ? htpasswdFile` is always
true in the module system (declared options always exist as keys); switch
to `nullOr path; default = null` + `!= null` check so the assertion
actually fires with a useful error when enable=true but no file is set.
Guard bind-mount and nginx config against null to prevent eval errors.

Update docs/gateway.md to show hivectl commands instead of raw htpasswd.

hive-c0re/src/coordinator.rs

@@ -708,11 +708,16 @@ impl Coordinator {
     /// whose stop the crash watcher should NOT classify as a crash.
     /// Lazily reaps entries older than `grace` so the map stays
     /// bounded by the active agent count.
-    pub fn recent_transient_within(&self, grace: std::time::Duration) -> HashMap<String, TransientKind> {
+    pub fn recent_transient_within(
+        &self,
+        grace: std::time::Duration,
+    ) -> HashMap<String, TransientKind> {
         let now = std::time::Instant::now();
         let mut map = self.recent_transient.lock().unwrap();
         map.retain(|_, (_, ts)| now.duration_since(*ts) <= grace);
-        map.iter().map(|(k, (kind, _))| (k.clone(), *kind)).collect()
+        map.iter()
+            .map(|(k, (kind, _))| (k.clone(), *kind))
+            .collect()
     }
 
     /// Set a transient state and return a guard that clears it on drop.