feat(#1843): static-serve the dashboard via the gateway, hive-c0re API-only

nginx proxied `<hive>/` straight to hive-c0re:7000, and hive-c0re served the
dashboard dist itself via `tower_http::ServeDir` (from `HIVE_STATIC_DIR` baked
into its service env). So a frontend-only change rebuilt the hive-c0re unit and
restarted the core daemon — every operator session dropped its SSE stream for a
pure CSS/JS change.

The gateway nginx now static-serves the dashboard dist directly; hive-c0re's
dashboard router is API-only. The split uses the Accept-header SPA fallback (the
same `map $http_accept` pattern the matrix/agent vhosts already use), so no
backend prefix has to be enumerated: a browser navigation (Accept: text/html)
whose path is not an on-disk asset gets the SPA index.html; everything else
(every /api route, the bare action/mutation routes, the two SSE streams, the
knowledge webhook — all Accept != text/html) falls through `try_files` to the
`@c0re` named location and is reverse-proxied to hive-c0re. A new c0re route
needs no gateway change.

- hive-c0re.nix: expose the themed dist as a new internal read-only option
  `services.hyperhive.c0re.servedFrontend`; drop `HIVE_STATIC_DIR` from the
  service env (the router no longer serves files).
- hive-gateway.nix: read that option in host-module scope (dashboardDist),
  static-serve `dashboard/` with the Accept-header `try_files ... @c0re` split;
  `@c0re` carries `proxy_buffering off` + a 1d read timeout for the SSE streams
  and a duplicated auth_basic block (named locations do not inherit it). The
  dashboard map is unconditional; the matrix map stays gated on the matrix GUI.
- dashboard.rs: drop the ServeDir fallback + the HIVE_STATIC_DIR resolution; the
  router 404s unmatched paths (the gateway only proxies non-static requests).
- hive-c0re/Cargo.toml: drop the now-unused tower-http dependency.
- docs/gateway.md: document the dashboard static split + the `@c0re` fall-through.

The store path is reachable inside the gateway nspawn container (shared
/nix/store), mirroring how HIVE_AGENT_FRONTEND_DIR already exposes the per-agent
UIs. The gateway and c0re changes must land together (atomic cutover) or the
dashboard 404s — this needs a watched gateway + c0re rebuild.

nix/modules/hive-c0re.nix

@@ -368,6 +368,19 @@ in
         endpoints) is the source of truth for any replacement.
       '';
     };
+    servedFrontend = lib.mkOption {
+      type = lib.types.package;
+      internal = true;
+      readOnly = true;
+      default = servedFrontend;
+      defaultText = lib.literalExpression "<stylix-themed overlay of `frontend`>";
+      description = ''
+        Internal, read-only: `frontend` re-themed with the active stylix
+        palette (or `frontend` verbatim when unthemed); has `dashboard/`
+        and `agent/`. Exposed so `hive-gateway.nix` can static-serve
+        `dashboard/` as an nginx root instead of proxying to hive-c0re.
+      '';
+    };
     assets = lib.mkOption {
       type = lib.types.package;
       default = hyperhiveAssets pkgs.stdenv.hostPlatform.system;
@@ -721,10 +734,8 @@ in
         # the writable StateDirectory.
         HOME = "/var/lib/hyperhive";
         HYPERHIVE_GIT = "${pkgs.git}/bin/git";
-        # Path to the dashboard static dist. The hive-c0re axum router
-        # serves this via `tower_http::ServeDir` for any path it doesn't
-        # match against an API/action route.
-        HIVE_STATIC_DIR = "${servedFrontend}/dashboard";
+        # No HIVE_STATIC_DIR: the gateway static-serves the dashboard dist
+        # now (see hive-gateway.nix); this router is API-only.
         # Path to the base agent frontend dist. hive-c0re's
         # gateway_nginx.rs uses this to generate split location
         # blocks in agents.conf — static HTML/CSS/JS served from the