matrix apiUrl: default to https on the gateway vhost

hive-c0re logs in with the hive's matrix sender token and creates the
Space and rooms over swarm.matrix.apiUrl. On a hive that does not run
the homeserver that crosses the network, so the default is now
https://<gatewayHost>. hive-c0re already verifies against the hive trust
bundle (SSL_CERT_FILE: system CAs, swarm root and the store's services
root), which covers the gateway's leaf for that name.

Also drops the remaining loopback-default wording in hive-c0re's matrix
module and the openFirewall description, and pins the https default on a
hive host without the homeserver in module-eval-matrix-core.

nix/module-eval/matrix-core.nix

@@ -31,6 +31,10 @@ let
   # The same hive with the identity taken away, which separates "a homeserver
   # is deployed" from "this host can authenticate to the store".
   matrixNoBaoIdentity = hive { deploy.matrix.enable = true; };
+
+  # A hive host that does not run the homeserver: its hive-c0re reaches the
+  # homeserver across the network.
+  matrixElsewhere = hive { };
   cases = [
     {
       # Absence arm, and what makes the one above able to fail: with no leaf
@@ -74,6 +78,18 @@ let
         && !(s.hive-c0re.environment ? BAO_ADDR)
         && !(lib.any (c: lib.hasPrefix "bao-" c) s.hive-c0re.serviceConfig.LoadCredential);
     }
+    {
+      # hive-c0re logs in with the hive's matrix token over this URL, and on a
+      # host without the homeserver that login crosses the network, so the
+      # default must be TLS all the way to the daemon's environment.
+      name = "hive-c0re provisions matrix over https from a hive that does not run it";
+      ok =
+        !matrixElsewhere.services.hyperhive.deploy.matrix.enable
+        && matrixElsewhere.services.hyperhive.swarm.matrix.apiUrl == "https://chat.t.local"
+        &&
+          matrixElsewhere.systemd.services.hive-c0re.environment.HIVE_MATRIX_API_URL
+          == "https://chat.t.local";
+    }
   ];
 in
 runGroup "matrix-core" cases