feat(gateway): hivectl gateway user management + fix htpasswdFile assertion

Add `hivectl gateway {create-user,delete-user,list-users}` subcommands for
managing htpasswd files used by gateway Basic auth. Pure Rust bcrypt
(cost 12, $2y$ prefix nginx accepts). No external htpasswd binary required.

Also fix the NixOS module assertion: `cfg.auth ? htpasswdFile` is always
true in the module system (declared options always exist as keys); switch
to `nullOr path; default = null` + `!= null` check so the assertion
actually fires with a useful error when enable=true but no file is set.
Guard bind-mount and nginx config against null to prevent eval errors.

Update docs/gateway.md to show hivectl commands instead of raw htpasswd.

hive-forge/src/client.rs

@@ -180,7 +180,12 @@ impl Client {
         let form = reqwest::blocking::multipart::Form::new()
             .file("attachment", file)
             .with_context(|| format!("read {}", file.display()))?;
-        let resp = self.http.post(&url).multipart(form).send().context("POST")?;
+        let resp = self
+            .http
+            .post(&url)
+            .multipart(form)
+            .send()
+            .context("POST")?;
         decode_json(resp, &format!("POST {url}"))
     }
 }