docs(gateway): describe what is, not what changed

Per review: docs represent current state. Every "used to" / "no longer"
clause this branch introduced is gone — including the History section in
network.md, which was a whole subsection about a sync mechanism that
doesn't exist.

Where the removed clause was carrying a real constraint, the constraint
stays and is stated in the present tense instead of as a delta: nothing
narrows what the gateway's nginx can reach except the directory
permissions in front of a socket, and nothing bounds `ReloadGatewayNginx`
except the hard-coded unit name. Those read as rules now rather than as
the story of how they came to be rules.

hive-c0re/src/paths.rs

@@ -219,11 +219,11 @@ pub fn shared_root() -> PathBuf {
 pub const KNOWLEDGE_DIR: &str = "/var/lib/hyperhive/knowledge";
 
 /// `gateway/` — generated nginx include fragments for the gateway vhost.
-/// nginx runs on the host and reads this path directly; it used to be
-/// bind-mounted into a gateway container at `/run/hive-state/`, exposing
-/// this subdir *only* so the rest of `/var/lib/hyperhive/` (forge/matrix
-/// tokens, etc.) stayed out of reach. On the host that narrowing is the
-/// unit's sandbox, not a mount — nginx is not confined by this path.
+/// nginx runs on the host and reads this path directly. ⚠️ Nothing about
+/// this path confines it: what keeps nginx away from the rest of
+/// `/var/lib/hyperhive/` (forge/matrix tokens, etc.) is the unit's own
+/// sandbox, so widening that sandbox widens what a gateway compromise
+/// reaches.
 // nix: named by the gateway's nginx config (hive-gateway/vhosts.nix) — must match.
 #[must_use]
 pub fn gateway_dir() -> PathBuf {