docs(gateway): describe what is, not what changed

Per review: docs represent current state. Every "used to" / "no longer"
clause this branch introduced is gone — including the History section in
network.md, which was a whole subsection about a sync mechanism that
doesn't exist.

Where the removed clause was carrying a real constraint, the constraint
stays and is stated in the present tense instead of as a delta: nothing
narrows what the gateway's nginx can reach except the directory
permissions in front of a socket, and nothing bounds `ReloadGatewayNginx`
except the hard-coded unit name. Those read as rules now rather than as
the story of how they came to be rules.

hive-c0re/src/dashboard/infra_containers.rs

@@ -5,9 +5,9 @@
 //! is reached from the dashboard — already fully operator-authenticated —
 //! so no capability check is needed here, just the same audit trail.
 //!
-//! The two surfaces no longer cover the same set: the gateway is the
-//! operator's to restart and not an agent's, since nginx on the host fronts
-//! every hive service. This endpoint keeps all four.
+//! The two surfaces cover different sets: this endpoint takes all four,
+//! while the agent path refuses the gateway — nginx on the host fronts
+//! every hive service, so bouncing it is the operator's call.
 
 use axum::{
     extract::{Path as AxumPath, State},

hive-c0re/src/dashboard/journal.rs

@@ -193,8 +193,7 @@ pub(super) async fn get_journal_host(
     axum::extract::Query(q): axum::extract::Query<JournalHostQuery>,
 ) -> Result<Response, ProblemDetails> {
     let lines = q.lines.unwrap_or(500).min(5000);
-    // `nginx.service` is the gateway: its logs used to live in the
-    // hive-gateway container's journal and are host-side now.
+    // `nginx.service` is the gateway — its logs are host-side.
     let allowed = ["hive-c0re.service", "hive-priv.service", "nginx.service"];
     let unit = match q.unit.as_deref().filter(|s| !s.is_empty()) {
         Some(u) => {