fix: use forge domain URL + open 80/443 for isolated agents

when isolateContainers=true, isolated agents have dnsmasq as their
resolver — forge.<domain> resolves to bridgeIp. route HIVE_FORGE_URL
through nginx on port 80 instead of exposing the raw forge port.

- HIVE_FORGE_URL: http://<forge.domain> when isolated (nginx proxies)
- bridge firewall: open 80+443 for agents to reach nginx (gateway)
- remove forge-specific httpPort rule (no longer needed)
- update docs/gateway.md + docs/network.md

per mara's review comment on PR #1150.

nix/modules/hive-c0re.nix

@@ -557,17 +557,17 @@ in
         HYPERHIVE_SWARM_NAME = config.services.hyperhive.swarmName;
       }
       // lib.optionalAttrs config.services.hyperhive.forge.enable {
-        # In-cluster forge URL. When containers are isolated (private netns),
-        # 127.0.0.1 is the container's own loopback — unreachable for host
-        # services. Use the bridge gateway IP instead; forgejo binds 0.0.0.0
-        # so it's reachable there. Shared-netns mode keeps loopback path.
-        # External `forge.<hive>` sub-domain isn't DNS-resolvable from inside
-        # nspawn either way. See `docs/gateway.md::HIVE_FORGE_URL`.
+        # In-cluster forge URL.
+        # - Isolated (private netns): containers resolve `forge.<domain>` via
+        #   the bridge dnsmasq and reach nginx on port 80. No raw forge port
+        #   needed — nginx proxies to forgejo as it does for the operator.
+        # - Shared netns: host loopback is reachable, use direct port.
+        # See `docs/gateway.md::HIVE_FORGE_URL`.
         HIVE_FORGE_URL =
           if
             config.services.hyperhive.network.enable && config.services.hyperhive.network.isolateContainers
           then
-            "http://${config.services.hyperhive.network.bridgeIp}:${toString config.services.hyperhive.forge.httpPort}"
+            "http://${config.services.hyperhive.forge.domain}"
           else
             "http://127.0.0.1:${toString config.services.hyperhive.forge.httpPort}";
       }