fix: assert gateway.enable when isolateContainers + forge.enable

isolated agents reach forge via http://forge.<domain> → nginx.
without the gateway there is nothing on port 80 to serve that
hostname. assert early rather than fail silently at runtime.

addresses argus yellow note on PR #1150.

nix/modules/hive-network.nix

@@ -196,6 +196,18 @@ in
             resolver must be running before isolation is flipped on).
           '';
         }
+        {
+          assertion =
+            !config.services.hyperhive.forge.enable || config.services.hyperhive.gateway.enable;
+          message = ''
+            services.hyperhive.network.isolateContainers = true with
+            services.hyperhive.forge.enable = true requires
+            services.hyperhive.gateway.enable = true — isolated agents
+            reach the forge via `http://forge.<domain>` which nginx (in
+            the gateway container) proxies to forgejo. Without the gateway
+            there is nothing listening on port 80 to serve that hostname.
+          '';
+        }
       ];
     })