fix: use forge domain URL + open 80/443 for isolated agents

when isolateContainers=true, isolated agents have dnsmasq as their
resolver — forge.<domain> resolves to bridgeIp. route HIVE_FORGE_URL
through nginx on port 80 instead of exposing the raw forge port.

- HIVE_FORGE_URL: http://<forge.domain> when isolated (nginx proxies)
- bridge firewall: open 80+443 for agents to reach nginx (gateway)
- remove forge-specific httpPort rule (no longer needed)
- update docs/gateway.md + docs/network.md

per mara's review comment on PR #1150.

nix/modules/hive-network.nix

@@ -215,16 +215,13 @@ in
         ip saddr ${cfg.bridgeIp}/${toString cfg.bridgePrefixLength} ip daddr 127.0.0.0/8 drop
       '';
 
-      # Allow isolated agents to reach the forge via the bridge gateway IP.
-      # Forgejo binds 0.0.0.0 so it's reachable at `bridgeIp:httpPort` from
-      # inside agent containers; without this rule the default INPUT policy
-      # drops the connection before it reaches forgejo. Only added when forge
-      # is enabled — no-op otherwise.
-      networking.firewall.interfaces.${cfg.bridgeName}.allowedTCPPorts =
-        lib.optionals config.services.hyperhive.forge.enable
-          [
-            config.services.hyperhive.forge.httpPort
-          ];
+      # Allow isolated agents to reach the gateway (nginx on the host, shared
+      # netns). Port 80 covers `http://forge.<domain>`, per-agent UI proxies,
+      # and any other HTTP services the gateway fronts. Port 443 for HTTPS.
+      networking.firewall.interfaces.${cfg.bridgeName}.allowedTCPPorts = [
+        80
+        443
+      ];
 
       # Tells hive-c0re to pass PRIVATE_NETWORK + bridge settings to each
       # container. HIVE_NETWORK_SUBNET is host-bridge IP/prefix, not canonical