refactor(3202): the gateway takes contributed dns names

Adds `services.hyperhive.gateway.localNames` (internal): hostnames the
hive resolver answers with the bridge IP, contributed by the modules
that own them. The service says which name, the gateway says where it
points — the same split `lib.tlsFor` already makes.

No behaviour change yet: the list is empty until the service modules
contribute in the following commits.

The assertion is not defensive padding. Duplicate `address=` rules do
not make dnsmasq complain; it resolves them by precedence, so a name
claimed twice silently stops being served by one of its claimants. That
failure mode only becomes reachable because contribution is now open, so
it gets closed in the same commit that opens it.

nix/host-modules/hive-gateway/options.nix

@@ -94,6 +94,29 @@ in
       '';
     };
 
+    localNames = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      internal = true;
+      description = ''
+        Extra hostnames the hive's resolver answers with the bridge IP,
+        contributed by the modules that own those names.
+
+        A service module says **which name**; the gateway decides
+        **where it points** — the same split as `lib.tlsFor`. A service
+        that hardcoded the bridge IP would be one more place to fix when
+        the network layout changes, and it has no business knowing it.
+
+        ⚠️ Contribute a name only when THIS host actually serves it. The
+        list is not "names the swarm has" —
+        `services.hyperhive.swarm.serviceDomains` is that, and it is
+        deliberately broader (it drives certificate issuance, so it
+        includes names this hive may only be a client of). Publishing an
+        address record for a service you do not run points every agent
+        on the bridge at a door that isn't there.
+      '';
+    };
+
     lib = {
       listen = lib.mkOption {
         type = lib.types.listOf (lib.types.attrsOf lib.types.raw);