matrix apiUrl: default to https on the gateway vhost

hive-c0re logs in with the hive's matrix sender token and creates the
Space and rooms over swarm.matrix.apiUrl. On a hive that does not run
the homeserver that crosses the network, so the default is now
https://<gatewayHost>. hive-c0re already verifies against the hive trust
bundle (SSL_CERT_FILE: system CAs, swarm root and the store's services
root), which covers the gateway's leaf for that name.

Also drops the remaining loopback-default wording in hive-c0re's matrix
module and the openFirewall description, and pins the https default on a
hive host without the homeserver in module-eval-matrix-core.

nix/host-modules/hive-c0re/default.nix

@@ -126,15 +126,12 @@ in
   imports = [
     ./options.nix
     ./theme.nix
-    # Hive-CA trust for this daemon's outbound TLS. Nothing it is given by
-    # default is https — the forge and matrix URLs are plain http, and the
-    # queue's TLS is verified against `HIVE_C0RE_OIDC_CA_FILE`
-    # (../hive-tls.nix), not this bundle — so this
-    # changes nothing on an all-local hive. It matters for the split-host
-    # shape the options invite: `swarm.matrix.apiUrl`'s own example is
-    # `https://matrix.example.com`, and pointing it at another hive's
-    # gateway means verifying a leaf signed by a CA generated at runtime,
-    # which no build-time trust store can contain.
+    # Hive-CA trust for this daemon's outbound TLS. The matrix provisioning
+    # URL (`swarm.matrix.apiUrl`) defaults to https on the homeserver's
+    # gateway vhost, which serves a leaf chaining to the store's services
+    # root or the swarm root — CAs generated at runtime, which no
+    # build-time trust store can contain. The queue's TLS is verified
+    # against `HIVE_C0RE_OIDC_CA_FILE` (../hive-tls.nix), not this bundle.
     #
     # ⚠️ `SSL_CERT_FILE` REPLACES the trust store, and unlike the other
     # consumers of this helper, hive-c0re already makes a *public*-TLS call: