nix: add breaking-change note to each openFirewall description (argus #653)

argus picked option (a) on #653: put the upgrade note in each option's
`description` so it shows up in `nix flake show` + the rendered
options docs, right next to the option itself. cheapest option, no
eval-time noise (a `warnings` block would fire on every new
deployment that wants false — the normal case now).

Appended a `**Breaking change as of #651**` paragraph to each of the
three `openFirewall` descriptions, naming the exact option string the
operator needs to set to restore the old behaviour.

Gateway's note specifically calls out that external reach is the
common case (operator's primary entry point), so the upgrade hint
is most likely needed there.

nix/modules/hive-forge.nix

@@ -98,6 +98,11 @@ in
         the operator's browser / external git clients to hit the
         forge directly. (The container shares host netns, so this
         is the only firewall layer that matters.)
+
+        **Breaking change as of #651**: this used to default to
+        `true`. If you relied on the old default for external
+        reach, add `services.hyperhive.forge.openFirewall = true;`
+        to your host config before rebuilding.
       '';
     };
   };

nix/modules/hive-gateway.nix

@@ -93,6 +93,12 @@ in
         nginx vhost. Leave off when running behind another reverse
         proxy (e.g. caddy / traefik on the host) that handles TLS
         termination + forwards to `port`.
+
+        **Breaking change as of #651**: this used to default to
+        `true`. If you relied on the old default for external reach
+        (the common case — the gateway is the operator's primary
+        entry point), add `services.hyperhive.gateway.openFirewall = true;`
+        to your host config before rebuilding.
       '';
     };
 

nix/modules/hive-matrix.nix

@@ -109,6 +109,11 @@ in
         the homeserver to other hives or when an external matrix
         client needs to reach the client-server API directly.
 
+        **Breaking change as of #651**: this used to default to
+        `true`. If you relied on the old default for external reach,
+        add `services.hyperhive.matrix.openFirewall = true;` to
+        your host config before rebuilding.
+
         Note: federation (the matrix-spec well-known port 8448) is
         intentionally not opened here. tuwunel serves the federation
         API on the same `httpPort` as the client-server API by