feat(gateway): hivectl gateway user management + fix htpasswdFile assertion

Add `hivectl gateway {create-user,delete-user,list-users}` subcommands for
managing htpasswd files used by gateway Basic auth. Pure Rust bcrypt
(cost 12, $2y$ prefix nginx accepts). No external htpasswd binary required.

Also fix the NixOS module assertion: `cfg.auth ? htpasswdFile` is always
true in the module system (declared options always exist as keys); switch
to `nullOr path; default = null` + `!= null` check so the assertion
actually fires with a useful error when enable=true but no file is set.
Guard bind-mount and nginx config against null to prevent eval errors.

Update docs/gateway.md to show hivectl commands instead of raw htpasswd.

hive-c0re/src/reminder_scheduler.rs

@@ -130,8 +130,7 @@ pub fn write_payload(agent: &str, host_path: &Path, message: &str) -> Result<(),
     let Some(parent) = host_path.parent() else {
         return Err("internal: host path has no parent".to_owned());
     };
-    std::fs::create_dir_all(parent)
-        .map_err(|e| format!("parent dir create failed: {e}"))?;
+    std::fs::create_dir_all(parent).map_err(|e| format!("parent dir create failed: {e}"))?;
     // Resolve symlinks in the parent chain, then re-verify the
     // canonical form still lives under the agent's host state root —
     // catches `ln -s /etc state/escape` style attacks.