feat(gateway): assert hsts.enable requires TLS

Addresses mara's review: add a NixOS assertion that rejects
hsts.enable = true when no TLS mode is configured. HSTS over
plain HTTP is silently ignored by browsers; the assertion turns
a silent misconfiguration into a build-time error.

nix/modules/hive-gateway.nix

@@ -417,6 +417,18 @@ in
           Let's Encrypt needs a contact address for the ACME account.
         '';
       }
+      {
+        assertion =
+          !cfg.hsts.enable
+          || cfg.selfSignedTls
+          || cfg.tls.certDir != null
+          || cfg.tls.acme.enable;
+        message = ''
+          services.hyperhive.gateway.hsts.enable = true requires TLS to be
+          configured (selfSignedTls, tls.certDir, or tls.acme.enable). HSTS
+          over plain HTTP is ignored by browsers and indicates a config error.
+        '';
+      }
     ];
 
     # Ensure bind-mount sources exist at host boot before the gateway