gateway: declare the gateway's own vhosts under gateway.vhosts

The catch-all, the dashboard and the hive-domain vhost were built in
vhosts.nix with the listen set, TLS attrs and headers applied by hand.
They are declared under services.hyperhive.gateway.vhosts now, so every
vhost behind the gateway goes through declared-vhosts.nix.

Two gateway-side rules cover what the catch-all needed: a vhost can set
securityHeaders = false (the catch-all only returns 444), and `default`
is rendered at mkDefault priority so an operator's own default vhost
still wins. The matrix discovery locations are unchanged.

The rendered nginx vhosts are unchanged.

nix/host-modules/hive-gateway/options.nix

@@ -142,6 +142,15 @@ in
           # Every other attribute is an nginx vhost option, passed through
           # to `services.nginx.virtualHosts.<name>` as written.
           freeformType = lib.types.attrsOf lib.types.anything;
+          options.securityHeaders = lib.mkOption {
+            type = lib.types.bool;
+            default = true;
+            description = ''
+              Whether the gateway puts its security headers ahead of this
+              vhost's `extraConfig`. Off only for a vhost that answers no
+              request with a response, such as the catch-all.
+            '';
+          };
           options.certificate = lib.mkOption {
             type = lib.types.nullOr (
               lib.types.submodule {
@@ -178,7 +187,10 @@ in
         - the TLS attributes for that name (`gateway.lib.tlsFor`, or
           `certificate` below), with `addSSL` dropped when the vhost sets
           `forceSSL`;
-        - `securityHeaders`, placed ahead of the vhost's own `extraConfig`.
+        - `securityHeaders`, placed ahead of the vhost's own `extraConfig`
+          unless the vhost sets `securityHeaders = false`;
+        - `default`, when a vhost sets it, at `mkDefault` priority, so an
+          operator's own `default` can win.
 
         A vhost that sets `listen`, `addSSL`, `onlySSL`, `enableACME`,
         `useACMEHost`, `sslCertificate` or `sslCertificateKey` itself fails