docs/gateway.md: extract big-picture gateway docs, trim in-code comments (mara #775:9988)

mara on PR #775: "this is too much docs in code - move bigger picture
stuff to md files and put refs in code"

New `docs/gateway.md` consolidates the gateway architecture story
that was spreading across long inline comments in `hive-gateway.nix`,
`hive-matrix.nix`, and `hive-forge.nix`:

- vhost map (which URL serves what, which upstream, which option)
- matrix discovery flow (.well-known → sub-domain delegation
  sequence)
- Accept-header SPA fallback pattern (#686 / #729 design history)
- local-dev `localHostsEntry` story
- sub-domain rationale (mara verdict tracking) + when sub-path is
  right (hyperhive-internal apps)
- per-vhost tuning knobs (forge LFS, matrix long-poll, agent SSE)
- sequencing history (which PR added which routing piece)

In-code comments in the two nix modules get trimmed to short refs
into the doc — keeps the *why* in the markdown while the *what*
stays alongside the code:

- hive-gateway.nix: top-of-file comment, `agentPortsTable`,
  `appendHttpConfig`, every location block + vhost
- hive-matrix.nix: `fluffychat-web-fixed`, `fluffychat-web-imaging`,
  the dart compile postInstall

README.md gets a new row in the docs table pointing at gateway.md.

Verified `nix eval` still resolves the same vhost + location layout
after the comment trim — no behavioral change, just less in-code
prose.

README.md

@@ -42,6 +42,7 @@ Depth lives in [`docs/`](docs/) — pick the one matching your task:
 | config-edit + approval state machine | [`docs/approvals.md`](docs/approvals.md) |
 | what survives destroy / purge / restart | [`docs/persistence.md`](docs/persistence.md) |
 | naming, wire protocol, commit style | [`docs/conventions.md`](docs/conventions.md) |
+| nginx vhost map + sub-domain routing | [`docs/gateway.md`](docs/gateway.md) |
 | NixOS / nspawn gotchas | [`docs/gotchas.md`](docs/gotchas.md) |
 
 ## Host config