feat(gateway): hivectl gateway user management + fix htpasswdFile assertion

Add `hivectl gateway {create-user,delete-user,list-users}` subcommands for
managing htpasswd files used by gateway Basic auth. Pure Rust bcrypt
(cost 12, $2y$ prefix nginx accepts). No external htpasswd binary required.

Also fix the NixOS module assertion: `cfg.auth ? htpasswdFile` is always
true in the module system (declared options always exist as keys); switch
to `nullOr path; default = null` + `!= null` check so the assertion
actually fires with a useful error when enable=true but no file is set.
Guard bind-mount and nginx config against null to prevent eval errors.

Update docs/gateway.md to show hivectl commands instead of raw htpasswd.

hive-c0re/src/meta.rs

@@ -572,7 +572,10 @@ where
         // Emit `capabilities = "cap1,cap2"` when the operator has
         // granted capabilities to this agent. Absent entry = null = no
         // capability env var injected, capability-gated tools hidden.
-        let caps = capabilities_map.get(&spec.name).cloned().unwrap_or_default();
+        let caps = capabilities_map
+            .get(&spec.name)
+            .cloned()
+            .unwrap_or_default();
         let capabilities_attr = if caps.is_empty() {
             "null".to_owned()
         } else {