matrix: drop the shared-netns claims the netns move left behind

network.md listed matrix among the shared-netns containers and the
private-netns list named only agents and the CI runner; it now says
every privateNetwork container keeps its own firewall. The authelia
module no longer calls the matrix container shared, and the hive-c0re
comment on having no homeserver fallback no longer names port 8008.

Part of #4815.

docs/networking/network.md

@@ -164,7 +164,7 @@ agent containers.
   UI proxies, and any other HTTP services.
 
 The **host** firewall is the only firewall. The swarm service
-containers that share the host netns (forge, matrix, authelia, bao, the
+containers that share the host netns (forge, authelia, bao, the
 metrics and log stores) run with `networking.firewall.enable = false`
 (`nix/container-modules/swarm-container.nix`): a NixOS firewall inside a
 shared-netns container runs against the _host_ ruleset — at container
@@ -172,7 +172,7 @@ boot its `firewall-start` flushes the `nixos-fw` chains, rebuilds them
 from the container's (empty) port list, and deletes the host's
 `nixos-nat-*` chains without recreating them, silently wiping the
 bridge holes above plus the agents' NAT. Private-netns containers
-(agents, swarm-ci-runner) may keep their own firewall — it's scoped to their
+(every container with `privateNetwork = true`: agents and the service containers on the bridge) keep their own firewall — it's scoped to their
 namespace.
 
 ### Reaching host services (`exposeHostPorts`)

hive-c0re/src/matrix.rs

@@ -18,7 +18,7 @@ use reqwest::StatusCode;
 ///
 /// `None` means **this hive has no homeserver to provision against** and
 /// every matrix path no-ops — see [`is_present`]. There is deliberately no
-/// fallback: `localhost:8008` is right only when the homeserver happens to
+/// fallback: a loopback default is right only when the homeserver happens to
 /// share this daemon's netns, and an address baked into the binary is one
 /// that builds fine and then talks to the wrong machine. The nix module
 /// defaults it to `https://` on the homeserver's gateway vhost, on every

nix/host-modules/swarm-authelia.nix

@@ -492,7 +492,7 @@ let
     mv ${lib.escapeShellArg "${clientsFile}.tmp"} ${lib.escapeShellArg clientsFile}
   '';
 
-  # Shared host netns, like the forge and matrix containers: the
+  # Shared host netns, like the forge container: the
   # gateway reaches authelia at 127.0.0.1:<port>.
   privateNetwork = false;
 in