refactor(3202): the gateway takes contributed dns names

Adds `services.hyperhive.gateway.localNames` (internal): hostnames the
hive resolver answers with the bridge IP, contributed by the modules
that own them. The service says which name, the gateway says where it
points — the same split `lib.tlsFor` already makes.

No behaviour change yet: the list is empty until the service modules
contribute in the following commits.

The assertion is not defensive padding. Duplicate `address=` rules do
not make dnsmasq complain; it resolves them by precedence, so a name
claimed twice silently stops being served by one of its claimants. That
failure mode only becomes reachable because contribution is now open, so
it gets closed in the same commit that opens it.

nix/host-modules/hive-gateway/dnsmasq.nix

@@ -7,6 +7,7 @@
 # are computed by hive-network.
 {
   lib,
+  cfg, # services.hyperhive.gateway
   networkCfg,
   forgeCfg,
   matrixCfg,
@@ -79,7 +80,17 @@
     # Reachability is not the access control here: the vhost's
     # `auth_request` + authelia's `group:operators` rule are, and an
     # agent that resolves the name still cannot open the page.
-    ++ lib.optional uiCfg.enable "/${uiCfg.domain}/${networkCfg.bridgeIp}";
+    ++ lib.optional uiCfg.enable "/${uiCfg.domain}/${networkCfg.bridgeIp}"
+    # Names contributed by the modules that own them
+    # (`gateway.localNames`). Same address as everything above — the
+    # bridge IP is the gateway's answer for anything it fronts, and a
+    # contributing module neither knows nor should know it.
+    #
+    # `unique` is not tidiness: two modules claiming one name would
+    # otherwise emit two `address=` rules for it, and dnsmasq resolves
+    # that by precedence rather than by complaining. An assertion in
+    # ./default.nix makes the collision loud instead.
+    ++ map (name: "/${name}/${networkCfg.bridgeIp}") (lib.unique cfg.localNames);
     # DHCP pool covering all usable host addresses on the bridge
     # subnet — bounds computed by hive-network.nix from
     # bridgeIp/bridgePrefixLength. All containers (agents and service