feat(gateway): hivectl gateway user management + fix htpasswdFile assertion

Add `hivectl gateway {create-user,delete-user,list-users}` subcommands for
managing htpasswd files used by gateway Basic auth. Pure Rust bcrypt
(cost 12, $2y$ prefix nginx accepts). No external htpasswd binary required.

Also fix the NixOS module assertion: `cfg.auth ? htpasswdFile` is always
true in the module system (declared options always exist as keys); switch
to `nullOr path; default = null` + `!= null` check so the assertion
actually fires with a useful error when enable=true but no file is set.
Guard bind-mount and nginx config against null to prevent eval errors.

Update docs/gateway.md to show hivectl commands instead of raw htpasswd.

hive-sh4re/src/lib.rs

@@ -463,7 +463,6 @@ pub enum Request {
     },
 
     // ---- privileged (manager socket only for now) ---------------------------
-
     /// *(privileged)* Initialise a brand-new agent's proposed config repo
     /// and queue an approval for the operator to review.
     RequestInitConfig {
@@ -724,7 +723,6 @@ pub enum HelperEvent {
     },
 }
 
-
 /// Submission payload for `RequestSchedulePrompt`. Lives outside the
 /// enum so it can also serialize into the approval row's `commit_ref`
 /// (the dispatcher re-parses it on approve and inserts the schedule).
@@ -976,4 +974,3 @@ pub struct WireScheduleTarget {
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub last_result: Option<String>,
 }
-

hive-sh4re/src/priv_proto.rs

@@ -42,7 +42,6 @@ pub struct BindMount {
 #[serde(tag = "op", rename_all = "snake_case")]
 pub enum PrivRequest {
     // --- Container lifecycle ---
-
     /// `nixos-container start <name>`
     StartContainer { name: String },
 
@@ -67,11 +66,13 @@ pub enum PrivRequest {
     ListContainers,
 
     // --- Config file writes ---
-
     /// Update `/etc/nixos-containers/<container>.conf`: strip network-isolation
     /// vars, force `PRIVATE_NETWORK=0`, and set `EXTRA_NSPAWN_FLAGS` from the
     /// provided bind-mount list. Written by `lifecycle::set_nspawn_flags`.
-    WriteNspawnFlags { container: String, binds: Vec<BindMount> },
+    WriteNspawnFlags {
+        container: String,
+        binds: Vec<BindMount>,
+    },
 
     /// Write `/run/systemd/system/container@<container>.service.d/hyperhive-limits.conf`
     /// with `[Service]\nMemoryMax=<memory_max>\nCPUQuota=<cpu_quota>\n`.
@@ -87,7 +88,6 @@ pub enum PrivRequest {
     RemoveServiceDropin { container: String },
 
     // --- System ---
-
     /// Run `systemctl daemon-reload`.
     DaemonReload,
 
@@ -96,10 +96,13 @@ pub enum PrivRequest {
     ReloadGatewayNginx,
 
     // --- Socket dir ownership ---
-
     /// Set ownership of `/run/hive-agent/<agent_name>/` to `uid:gid`.
     /// Called by `lifecycle::set_nspawn_flags` after `create_dir_all`.
-    ChownSocketDir { agent_name: String, uid: u32, gid: u32 },
+    ChownSocketDir {
+        agent_name: String,
+        uid: u32,
+        gid: u32,
+    },
 
     /// Set mode of `/run/hive-agent/<agent_name>/`.
     /// Fallback when uid lookup returns `None` on first spawn.