refactor(3202): authelia declares its own vhost and dns name

Moves the authelia vhost out of the gateway's vhosts.nix and its
`address=` rule out of dnsmasq.nix, into swarm-authelia.nix.

Both land inside that module's existing `cfg.enable` guard, which is
the load-bearing part: every hive in a swarm knows `authelia.url`, but
only the host that RUNS the container may claim the name. A client hive
declaring the vhost would answer for a service it does not run, and
publishing the DNS record would point every agent on its bridge at that
wrong answer.

The kit grows a fourth member, `errorPages`, because the vhost aims its
502/503/504 at the gateway's styled sso-unavailable page. Republished
rather than imported per module: a service rendering its own would drift
from the rest of the gateway the first time the theme changed.

nix/host-modules/hive-gateway/options.nix

@@ -150,6 +150,22 @@ in
         '';
       };
 
+      errorPages = lib.mkOption {
+        type = lib.types.attrsOf lib.types.path;
+        internal = true;
+        readOnly = true;
+        description = ''
+          Read-only: the gateway's styled static error pages, by name
+          (`notFound`, `unreachable`, `unauthorized`, `ssoUnavailable`).
+
+          Published so a service module can aim an `error_page` at one
+          instead of rendering its own — a service that built its own
+          would drift from the rest of the gateway the first time the
+          theme changed, and the operator would meet two different
+          error styles on one hive.
+        '';
+      };
+
       securityHeaders = lib.mkOption {
         type = lib.types.lines;
         internal = true;