docs: follow the swarm service names to the swarm domain

The three moves above falsify prose in five files, and none of it is
caught by a gate: clippy, cargo test and nix flake check read exactly
zero markdown.

Corrected where a doc stated a DEFAULT or enumerated the vhosts --
gateway (ACME requirements + the header table + the two Forgejo
reachability lines), matrix (gatewayHost, firewall rationale, agent
reachability), network (container table + the HTTP resolution bullet),
turn-loop config, dashboard.

Two mentions are deliberately left alone. `docs/tools/hivectl.md` says
the URL is read from the daemon "instead of assuming forge.<domain>" --
that sentence is about not assuming a shape and stays true. And
matrix.md's breaking-change note describes what `serverName` USED to
default to; it is history, correctly labelled, and rewriting it would
erase the record of an earlier migration.

The ACME line gained a requirement rather than a rename: with the
service names under the swarm domain, every one of those names has to
resolve to this host, not just the hive's own.

docs/gateway.md

@@ -184,7 +184,7 @@ services.hyperhive.gateway = {
 
 nginx inside the gateway container obtains and auto-renews certs via the ACME HTTP-01 challenge on `port` (default 80). The gateway container shares the host network namespace (`privateNetwork = false`) so outbound ACME requests work without any extra routing. Certs are stored inside the container's persistent state dir (`/var/lib/acme/` inside `hive-gateway`; survives restarts because `ephemeral = false`).
 
-**Requirements**: `services.hyperhive.domain` must be publicly DNS-resolvable to this host, and `openFirewall = true` so Let's Encrypt can reach `/.well-known/acme-challenge/`. Each active vhost (main domain, `forge.<domain>`, `matrix.<domain>`) gets its own cert via separate ACME challenges.
+**Requirements**: `services.hyperhive.domain` must be publicly DNS-resolvable to this host, and `openFirewall = true` so Let's Encrypt can reach `/.well-known/acme-challenge/`. Each active vhost (main domain, `forge.<swarm-domain>`, `chat.<swarm-domain>`) gets its own cert via separate ACME challenges — the swarm services default to names under `services.hyperhive.swarm.domain`, so **every one of those names must resolve to this host too**, not just the hive's own.
 
 Mutual exclusion: `tls.certDir` set together with `tls.acme.enable = true` fails an assertion — pick one external TLS source (or neither, for the self-signed default).
 
@@ -308,8 +308,8 @@ The forge container shares the host network namespace
 host-side service — nixos-container is here for state + systemd-unit
 isolation, not network isolation. Note this is the FORGE container;
 agent containers are network-isolated and reach the forge through the
-gateway by `forge.<domain>` (see `HIVE_FORGE_URL` above), not via the
-host's loopback.
+gateway by `forge.<swarm-domain>` (see `HIVE_FORGE_URL` above), not via
+the host's loopback.
 
 State lives at `/var/lib/nixos-containers/hive-forge/var/lib/forgejo/`
 and survives container restart / host reboot. To wipe, destroy the
@@ -336,7 +336,7 @@ via `-p 2222`). Port 22 is left alone on the host for openssh.
 
 `openFirewall` (default **false**) controls whether `httpPort` and
 `sshPort` are opened in the host firewall. Off by default (secure by
-default): agents reach Forgejo through the gateway (`forge.<domain>` on
+default): agents reach Forgejo through the gateway (`forge.<swarm-domain>` on
 the bridge), not the raw port, so no firewall hole is needed. Flip to
 `true` when you need:
 - The operator's browser to reach `http://<host>:<httpPort>/` directly
@@ -542,7 +542,7 @@ ordering, preventing the subrequest from looping back through
 ## Security headers
 
 The following headers are emitted at server scope on every gateway
-vhost (`_`, `forge.<domain>`, `matrix.<domain>`):
+vhost (`_`, `forge.<swarm-domain>`, `chat.<swarm-domain>`):
 
 | Header | Value |
 |--------|-------|