feat(gateway): hivectl gateway user management + fix htpasswdFile assertion

Add `hivectl gateway {create-user,delete-user,list-users}` subcommands for
managing htpasswd files used by gateway Basic auth. Pure Rust bcrypt
(cost 12, $2y$ prefix nginx accepts). No external htpasswd binary required.

Also fix the NixOS module assertion: `cfg.auth ? htpasswdFile` is always
true in the module system (declared options always exist as keys); switch
to `nullOr path; default = null` + `!= null` check so the assertion
actually fires with a useful error when enable=true but no file is set.
Guard bind-mount and nginx config against null to prevent eval errors.

Update docs/gateway.md to show hivectl commands instead of raw htpasswd.

hive-forge/src/verbs/pr_create.rs

@@ -222,7 +222,9 @@ To http://localhost:3000/hyperhive/hyperhive.git\n\
         assert!(is_pr_hint_opener(
             "remote: Create a new pull request for 'x':\n"
         ));
-        assert!(is_pr_hint_opener("remote: Visit the existing pull request:\n"));
+        assert!(is_pr_hint_opener(
+            "remote: Visit the existing pull request:\n"
+        ));
         assert!(!is_pr_hint_opener("remote: some other thing\n"));
         assert!(!is_pr_hint_opener("To http://example.com\n"));
         // Trailing-CRLF safety on windows-cloned forge clones.