refactor(3202): matrix declares its own vhost, dns name and SPA map

Moves the matrix sub-domain vhost out of the gateway's vhosts.nix, its
`address=` rule out of dnsmasq.nix, and the Accept-header
`$matrix_spa_target` map out of the gateway's appendHttpConfig — all
three into hive-matrix.nix.

The map is the one that had no business being where it was: it exists
solely for the SPA fallback in the vhost's `/` location, and
`appendHttpConfig` is a `lines` option, so a module can contribute to
it without the gateway assembling it.

The `.well-known/matrix/*` delegation deliberately stays on the hive's
own vhost. The spec requires it at the SERVER NAME, which is the hive
domain: that is the hive answering "where is my homeserver", not the
homeserver answering for itself. Moving it would have been the obvious
symmetric thing and it would have been wrong.

nix/host-modules/hive-gateway/dnsmasq.nix

@@ -9,7 +9,6 @@
   lib,
   cfg, # services.hyperhive.gateway
   networkCfg,
-  matrixCfg,
   uiCfg,
   hyperhiveDomain,
 }:
@@ -54,20 +53,9 @@
     # Hive authoritative records — answer queries for the hive domain
     # + its sub-domains with the bridge IP, where nginx is reachable
     # from every container netns.
-    #
-    # The matrix entry is redundant in the common case where
-    # `matrix.gatewayHost` is a sub-domain of `hyperhive.domain` —
-    # dnsmasq's `/<domain>/` rule already matches sub-domains. Kept
-    # explicit because an operator can override it to a cross-domain
-    # hostname (e.g. `git.example.com` for the forge); listing such a
-    # name explicitly keeps that case routed without an extra config
-    # block.
     address = [
       "/${hyperhiveDomain}/${networkCfg.bridgeIp}"
     ]
-    ++ lib.optional (
-      matrixCfg.enable && matrixCfg.gatewayHost != null
-    ) "/${matrixCfg.gatewayHost}/${networkCfg.bridgeIp}"
     # The swarm UI's name is the swarm APEX by default — a sibling of
     # the three above, not a child of anything this resolver already
     # answers for, so the `/<hive domain>/` rule does not cover it.