feat(gateway): hivectl gateway user management + fix htpasswdFile assertion

Add `hivectl gateway {create-user,delete-user,list-users}` subcommands for
managing htpasswd files used by gateway Basic auth. Pure Rust bcrypt
(cost 12, $2y$ prefix nginx accepts). No external htpasswd binary required.

Also fix the NixOS module assertion: `cfg.auth ? htpasswdFile` is always
true in the module system (declared options always exist as keys); switch
to `nullOr path; default = null` + `!= null` check so the assertion
actually fires with a useful error when enable=true but no file is set.
Guard bind-mount and nginx config against null to prevent eval errors.

Update docs/gateway.md to show hivectl commands instead of raw htpasswd.

hive-c0re/src/priv_client.rs

@@ -7,7 +7,7 @@
 //! a persistent connection.
 
 use anyhow::{Context as _, Result, bail};
-use hive_sh4re::priv_proto::{PRIV_SOCK, BindMount, PrivRequest, PrivResponse};
+use hive_sh4re::priv_proto::{BindMount, PRIV_SOCK, PrivRequest, PrivResponse};
 use tokio::io::{AsyncBufReadExt, AsyncWriteExt, BufReader};
 use tokio::net::UnixStream;
 
@@ -31,27 +31,49 @@ pub async fn call(req: &PrivRequest) -> Result<PrivResponse> {
 }
 
 pub async fn start_container(name: &str) -> Result<()> {
-    ok(call(&PrivRequest::StartContainer { name: name.to_owned() }).await?)
+    ok(call(&PrivRequest::StartContainer {
+        name: name.to_owned(),
+    })
+    .await?)
 }
 
 pub async fn stop_container(name: &str) -> Result<()> {
-    ok(call(&PrivRequest::StopContainer { name: name.to_owned() }).await?)
+    ok(call(&PrivRequest::StopContainer {
+        name: name.to_owned(),
+    })
+    .await?)
 }
 
 pub async fn kill_container(name: &str) -> Result<()> {
-    ok(call(&PrivRequest::KillContainer { name: name.to_owned() }).await?)
+    ok(call(&PrivRequest::KillContainer {
+        name: name.to_owned(),
+    })
+    .await?)
 }
 
 pub async fn update_container(name: &str) -> Result<(String, String)> {
-    check(call(&PrivRequest::UpdateContainer { name: name.to_owned() }).await?)
+    check(
+        call(&PrivRequest::UpdateContainer {
+            name: name.to_owned(),
+        })
+        .await?,
+    )
 }
 
 pub async fn create_container(name: &str) -> Result<(String, String)> {
-    check(call(&PrivRequest::CreateContainer { name: name.to_owned() }).await?)
+    check(
+        call(&PrivRequest::CreateContainer {
+            name: name.to_owned(),
+        })
+        .await?,
+    )
 }
 
 pub async fn destroy_container(name: &str) -> Result<()> {
-    ok(call(&PrivRequest::DestroyContainer { name: name.to_owned() }).await?)
+    ok(call(&PrivRequest::DestroyContainer {
+        name: name.to_owned(),
+    })
+    .await?)
 }
 
 pub async fn list_containers() -> Result<String> {
@@ -63,7 +85,8 @@ pub async fn write_nspawn_flags(container: &str, binds: &[BindMount]) -> Result<
     ok(call(&PrivRequest::WriteNspawnFlags {
         container: container.to_owned(),
         binds: binds.to_vec(),
-    }).await?)
+    })
+    .await?)
 }
 
 pub async fn write_resource_limits(
@@ -75,13 +98,15 @@ pub async fn write_resource_limits(
         container: container.to_owned(),
         memory_max: memory_max.to_owned(),
         cpu_quota: cpu_quota.to_owned(),
-    }).await?)
+    })
+    .await?)
 }
 
 pub async fn remove_service_dropin(container: &str) -> Result<()> {
     ok(call(&PrivRequest::RemoveServiceDropin {
         container: container.to_owned(),
-    }).await?)
+    })
+    .await?)
 }
 
 pub async fn daemon_reload() -> Result<()> {
@@ -97,21 +122,26 @@ pub async fn chown_socket_dir(agent_name: &str, uid: u32, gid: u32) -> Result<()
         agent_name: agent_name.to_owned(),
         uid,
         gid,
-    }).await?)
+    })
+    .await?)
 }
 
 pub async fn chmod_socket_dir(agent_name: &str, mode: u32) -> Result<()> {
     ok(call(&PrivRequest::ChmodSocketDir {
         agent_name: agent_name.to_owned(),
         mode,
-    }).await?)
+    })
+    .await?)
 }
 
 fn check(resp: PrivResponse) -> Result<(String, String)> {
     if resp.ok {
         Ok((resp.stdout, resp.stderr))
     } else {
-        bail!("{}", resp.error.as_deref().unwrap_or("hive-priv returned error"))
+        bail!(
+            "{}",
+            resp.error.as_deref().unwrap_or("hive-priv returned error")
+        )
     }
 }