feat(gateway): hivectl gateway user management + fix htpasswdFile assertion

Add `hivectl gateway {create-user,delete-user,list-users}` subcommands for
managing htpasswd files used by gateway Basic auth. Pure Rust bcrypt
(cost 12, $2y$ prefix nginx accepts). No external htpasswd binary required.

Also fix the NixOS module assertion: `cfg.auth ? htpasswdFile` is always
true in the module system (declared options always exist as keys); switch
to `nullOr path; default = null` + `!= null` check so the assertion
actually fires with a useful error when enable=true but no file is set.
Guard bind-mount and nginx config against null to prevent eval errors.

Update docs/gateway.md to show hivectl commands instead of raw htpasswd.

hive-sh4re/src/lib.rs

@@ -463,7 +463,6 @@ pub enum Request {
     },
 
     // ---- privileged (manager socket only for now) ---------------------------
-
     /// *(privileged)* Initialise a brand-new agent's proposed config repo
     /// and queue an approval for the operator to review.
     RequestInitConfig {
@@ -724,7 +723,6 @@ pub enum HelperEvent {
     },
 }
 
-
 /// Submission payload for `RequestSchedulePrompt`. Lives outside the
 /// enum so it can also serialize into the approval row's `commit_ref`
 /// (the dispatcher re-parses it on approve and inserts the schedule).
@@ -976,4 +974,3 @@ pub struct WireScheduleTarget {
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub last_result: Option<String>,
 }
-