docs(gateway): describe what is, not what changed

Per review: docs represent current state. Every "used to" / "no longer"
clause this branch introduced is gone — including the History section in
network.md, which was a whole subsection about a sync mechanism that
doesn't exist.

Where the removed clause was carrying a real constraint, the constraint
stays and is stated in the present tense instead of as a delta: nothing
narrows what the gateway's nginx can reach except the directory
permissions in front of a socket, and nothing bounds `ReloadGatewayNginx`
except the hard-coded unit name. Those read as rules now rather than as
the story of how they came to be rules.

swarm-controller/README.md

@@ -42,11 +42,9 @@ What keeps that safe is that the directory holds **one** socket. So:
 > Pointing nginx at that directory to reach this socket would put the admin
 > socket within its reach too.
 
-This got *less* forgiving when nginx moved onto the host: the gateway used to
-reach a unix upstream through a bind-mount, so the mount list was a second
-bound on what it could touch. There is no mount now — the directory is the
-whole of the access control. A unit test pins the default path so a tidying
-edit fails instead of reviewing cleanly.
+nginx is a host service, so nothing narrows what it can reach except the
+directory itself — that is the whole of the access control. A unit test pins
+the default path so a tidying edit fails instead of reviewing cleanly.
 
 `RuntimeDirectoryPreserve=yes` and the daemon's stale-socket unlink on start are
 a **pair**: preserving the directory without the unlink means `bind` fails with

swarm-controller/src/main.rs

@@ -29,10 +29,8 @@ use axum::{Router, routing::get};
 /// The directory is its own — deliberately not shared with hive-c0re's
 /// `/run/hyperhive`. The socket is `0666`, so its directory is the only
 /// access control it has; co-locating it with c0re's admin socket would
-/// put both within reach of whatever can reach either. That used to be
-/// enforced by which *directory* was bind-mounted into the gateway
-/// container; with nginx on the host the mount is gone and the directory
-/// is all that is left, so the rule matters more, not less.
+/// put both within reach of whatever can reach either. nginx runs on the
+/// host, so nothing narrows its reach for you.
 const DEFAULT_SOCKET: &str = "/run/swarm-controller/controller.sock";
 
 fn socket_path() -> PathBuf {
@@ -98,9 +96,8 @@ mod tests {
     /// The socket must not share a directory with anything else, because
     /// the socket is `0666` and the directory is therefore the only access
     /// control it has. `/run/hyperhive` in particular holds hive-c0re's
-    /// **admin** socket. nginx used to reach a unix upstream by mounting
-    /// the socket's whole directory into the gateway container; it runs on
-    /// the host now, so nothing narrows its reach but the directory itself.
+    /// **admin** socket, and nginx — a host service — is bounded by
+    /// nothing but the directory itself.
     ///
     /// A test rather than a comment: the failure this guards against is a
     /// one-word edit that looks tidier and reads fine in review.