refactor(3202): authelia declares its own vhost and dns name

Moves the authelia vhost out of the gateway's vhosts.nix and its
`address=` rule out of dnsmasq.nix, into swarm-authelia.nix.

Both land inside that module's existing `cfg.enable` guard, which is
the load-bearing part: every hive in a swarm knows `authelia.url`, but
only the host that RUNS the container may claim the name. A client hive
declaring the vhost would answer for a service it does not run, and
publishing the DNS record would point every agent on its bridge at that
wrong answer.

The kit grows a fourth member, `errorPages`, because the vhost aims its
502/503/504 at the gateway's styled sso-unavailable page. Republished
rather than imported per module: a service rendering its own would drift
from the rest of the gateway the first time the theme changed.

nix/host-modules/hive-gateway/dnsmasq.nix

@@ -10,7 +10,6 @@
   cfg, # services.hyperhive.gateway
   networkCfg,
   matrixCfg,
-  autheliaCfg,
   uiCfg,
   hyperhiveDomain,
 }:
@@ -69,7 +68,6 @@
     ++ lib.optional (
       matrixCfg.enable && matrixCfg.gatewayHost != null
     ) "/${matrixCfg.gatewayHost}/${networkCfg.bridgeIp}"
-    ++ lib.optional autheliaCfg.enable "/${autheliaCfg.domain}/${networkCfg.bridgeIp}"
     # The swarm UI's name is the swarm APEX by default — a sibling of
     # the three above, not a child of anything this resolver already
     # answers for, so the `/<hive domain>/` rule does not cover it.