gateway: pin the Host header when dialing swarm services by name

verifiedProxyTo (43ae164d) verified TLS but left Host to nixpkgs'
recommendedProxySettings, which sets Host to the CALLING vhost, not
the target. Since every consumer resolves back to this same gateway,
nginx picks the vhost to answer by Host header (not by the SNI
proxy_ssl_name already sends) — so every auth subrequest looped back
into its own vhost's auth_request, recursing until nginx's subrequest
depth limit turned it into a 500, on every domain gated by SSO.

Pin Host (and the rest of the header set nixpkgs' recommended include
would otherwise still be the one to set) inside verifiedProxyTo, and
set recommendedProxySettings = false on each of the four call sites so
nixpkgs' own copy — appended after a location's extraConfig — can't
clobber it back.

nix/host-modules/hive-forge/default.nix

@@ -517,6 +517,10 @@ in
             # co-location nobody had agreed to. The name resolves here
             # today and resolves off-host later without this line moving.
             proxyPass = "https://${autheliaCfg.domain}/api/authz/auth-request";
+            # nixpkgs appends its OWN `Host $host` after extraConfig,
+            # which would override verifiedProxyTo's — see the comment
+            # on verifiedProxyTo in hive-gateway/vhost-lib.nix.
+            recommendedProxySettings = false;
             extraConfig = ''
               internal;
               ${gatewayCfg.lib.verifiedProxyTo autheliaCfg.domain}