docs(gateway): describe what is, not what changed

Per review: docs represent current state. Every "used to" / "no longer"
clause this branch introduced is gone — including the History section in
network.md, which was a whole subsection about a sync mechanism that
doesn't exist.

Where the removed clause was carrying a real constraint, the constraint
stays and is stated in the present tense instead of as a delta: nothing
narrows what the gateway's nginx can reach except the directory
permissions in front of a socket, and nothing bounds `ReloadGatewayNginx`
except the hard-coded unit name. Those read as rules now rather than as
the story of how they came to be rules.

docs/security.md

@@ -191,16 +191,12 @@ directly invoke `nixos-container`, `journalctl -M`, or act on a system
 unit (`systemctl reload nginx`) — those require root. `hive-priv` fills
 this gap.
 
-⚠️ **Note what that costs when a helper verb loses its namespace.**
-`ReloadGatewayNginx` used to run `systemctl -M hive-gateway …`, and the
-`--machine=` flag was doing two jobs: it was the *transport* into the
-container **and** the *scope* — the verb could not reach anything
-outside that one machine. With nginx on the host the transport is
-unnecessary and the scope went with it, so the containment is now the
-hard-coded unit name in `hive-priv`: a caller cannot name the unit, so
-the verb cannot be steered at another service. **When a privileged verb
-stops needing a namespace, check whether the namespace was also what
-bounded it.**
+⚠️ **`ReloadGatewayNginx` acts on a host unit, so nothing implicitly
+scopes it.** Its containment is the unit name hard-coded in `hive-priv`:
+a caller cannot name the unit, so the verb cannot be steered at another
+service. **A privileged verb needs something bounding what it can act
+on; when that isn't a namespace, it has to be a constant the caller
+can't supply.**
 
 ### hive-priv