docs(3189): the error-page scope text describes the new shape

Two claims this branch falsified and left standing, both caught in
review:

`vhosts.nix`'s `errorPages` param comment enumerated the set
(`{ notFound, unreachable, unauthorized }`) and adding a fourth member
made the enumeration wrong at the point a reader consults it.

`gateway.md` said extending custom error pages beyond the per-agent
routes was "a separate follow-up" — while this branch is that follow-up,
so the doc contradicted the code sitting next to it.

Rewrites the scope rule as the criterion rather than a list, since a
list is what went stale: a route earns a page when the default status
would point at the wrong component. That covers the per-agent routes and
the sso vhost, and explains why forge/matrix/fluffychat still don't
qualify — their upstreams being down means what the code says.

nix/host-modules/hive-gateway/vhosts.nix

@@ -13,7 +13,7 @@
   hyperhiveDomain,
   dashboardDist,
   swaggerUiTheme, # nix/packages/swagger-ui-theme.nix: has index.html + hyperhive-theme.css
-  errorPages, # ./error-pages.nix: { notFound, unreachable, unauthorized }
+  errorPages, # ./error-pages.nix: { notFound, unreachable, unauthorized, ssoUnavailable }
   tlsCert,
   tlsKey,
   svcCert, # swarm-services leaf, for names the hive CA cannot sign