feat(gateway): hivectl gateway user management + fix htpasswdFile assertion

Add `hivectl gateway {create-user,delete-user,list-users}` subcommands for
managing htpasswd files used by gateway Basic auth. Pure Rust bcrypt
(cost 12, $2y$ prefix nginx accepts). No external htpasswd binary required.

Also fix the NixOS module assertion: `cfg.auth ? htpasswdFile` is always
true in the module system (declared options always exist as keys); switch
to `nullOr path; default = null` + `!= null` check so the assertion
actually fires with a useful error when enable=true but no file is set.
Guard bind-mount and nginx config against null to prevent eval errors.

Update docs/gateway.md to show hivectl commands instead of raw htpasswd.

hive-forge/src/verbs/subscription.rs

@@ -29,7 +29,11 @@ pub fn run(client: &Client, args: Args) -> Result<()> {
         return Ok(());
     }
     if args.watch || args.ignore {
-        let (subscribed, ignored) = if args.ignore { (false, true) } else { (true, false) };
+        let (subscribed, ignored) = if args.ignore {
+            (false, true)
+        } else {
+            (true, false)
+        };
         let resp = client.post_json(
             &format!("/repos/{repo}/subscription"),
             &json!({ "subscribed": subscribed, "ignored": ignored }),