docs: 10 cited nix options that do not exist, two in pasteable blocks

An option name that is absent reads exactly like one that is present —
the reader has no way to tell, and the failure surfaces as a nixos eval
error at deploy time. Two namespace reorgs the prose never followed:
`forge.*` moved under `swarm.`, and several flat paths under `c0re.`.

  docs/networking/gateway.md:335   services.hyperhive.forge = { … }
  docs/networking/gateway.md:367   forge.rootUrl        → swarm.forge.rootUrl
  docs/networking/gateway.md:389   frontend             → c0re.frontend
  docs/tools/hivectl.md:193        agentCpuQuota        → c0re.agentCpuQuota
  docs/tools/hivectl.md:317        forge.behindGateway  → swarm.forge.behindGateway
  docs/agent-lifecycle/persistence.md:404   agentCpuQuota → c0re.agentCpuQuota
  docs/web-ui/dashboard.md:610     modelPrices          → c0re.modelPrices
  docs/web-ui/dashboard.md:789     forge.publicUrl      → swarm.forge.publicUrl

Both `gateway.md` blocks are fenced nix an operator is meant to paste.

Two sites needed more than a rename:

  dashboard.md:781 cited `gateway.enable` as a live opt-in. It was
  removed; `gateway.md:269` already says the gateway is unconditional,
  and `hive-c0re/environment.nix:208` sets HIVE_GATEWAY_ENABLED = "1"
  with no condition. Rewritten to say so, keeping the flag-absent
  fallback the dashboard still implements.

  turn-loop/config.md:4 attributed the page's knobs to
  `services.hyperhive.agents.<name>`. No such option exists — every
  knob the page documents is agent-side `hyperhive.*`, set in the
  agent's own agent.nix.

Measured against the module system rather than a grep: `nix build
.#docs` renders nixosOptionsDoc over the evaluated trees (279 option
paths). That arm alone is wrong — it omits `internal = true` options
and called `gateway.localNames` and `swarm.peerHives` dead, so a second
arm requires the literal path to appear in nix/ and rescues exactly
those. Four remaining unresolved citations are correct prose saying
`gateway.enable` / `network.{enable,isolateContainers,upstreamDns}`
were removed, and are left alone.

Closes #3948

docs/web-ui/dashboard.md

@@ -607,7 +607,7 @@ library.
 The cost figure is a deliberately rough estimate from a per-model
 price table (`est_cost_usd`); it drifts with list pricing and is
 labelled accordingly. The table is operator-tunable via the
-`services.hyperhive.modelPrices` nix option — each key is a
+`services.hyperhive.c0re.modelPrices` nix option — each key is a
 model-family short name (matched case-insensitively as a substring of
 the model id, longest match wins) mapping to
 `{ input, output, cache_read, cache_write }` USD-per-million-token
@@ -777,16 +777,18 @@ cache), `rate_limited`, `ctx_tokens` / `context_window_tokens`
 of truth for all of these. The dashboard resolves each `AgentLink.kind`
 against a per-agent base URL depending on whether hive-gateway is in
 front (`StateSnapshot.gateway_enabled`, sourced from the
-`HIVE_GATEWAY_ENABLED` env the c0re NixOS module sets when
-`services.hyperhive.gateway.enable = true`). Gateway-on (default):
-base URL is `/agent/<name>` (same origin, gateway proxies to the
+`HIVE_GATEWAY_ENABLED` env). The c0re NixOS module sets that env
+unconditionally — the gateway always runs; the flag stays so the
+dashboard doesn't have to learn that. Gateway-on: base URL is
+`/agent/<name>` (same origin, gateway proxies to the
 per-agent harness — TCP or unix-domain depending on the agent's
 `HIVE_WEB_SOCKET` opt-in, see
 `docs/networking/gateway.md::Per-agent unix-socket upstream`).
-Gateway-off (legacy / local dev): base URL is
-`http://<host>:<container.port>` (direct TCP fallback). Forge
+Gateway-off is the flag-absent fallback (a dashboard served outside a
+hyperhive deploy): base URL is
+`http://<host>:<container.port>` (direct TCP). Forge
 links resolve against `state.forge_public_url` (sourced from
-`services.hyperhive.forge.publicUrl`) and are omitted entirely when
+`services.hyperhive.swarm.forge.publicUrl`) and are omitted entirely when
 that's unset — never guessed from `<host>:3000`. External links are
 already absolute. The same base URL drives the primary agent-name
 link + favicon fetch, so the whole row routes through the gateway