forge: always behind the gateway; drop behindGateway

The forge always sits behind the gateway, so `deploy.forgejo.behindGateway`
(and its `swarm.forge.behindGateway` rename alias) is removed and its
true-branch behaviour is now unconditional within `deploy.forgejo.enable`:
https ROOT_URL on the gateway's httpsPort, the forge vhost and local DNS
name, the swarm-ui quick link, the published metrics scrape target, forgejo
metrics, the authelia `/metrics` rule, and `publicUrl` defaulting to
`https://<forge.domain>`.

Removed with it: the direct-port `http://<domain>:<httpPort>/` ROOT_URL
branch, the hive-ci assertion that the option is true, the core-toggle
cases that only exercised the false branch (the services-leaf case reads
`bare`, which never enabled the forge either). `hivectl open forge` now
points at `swarm.forge.publicUrl`, which can still be set to null.

Refs #4885

hive-c0re/src/dashboard/state_snapshot.rs

@@ -94,8 +94,7 @@ pub(super) struct StateSnapshot {
     /// `"https://forge.pr1ma.darkest.space"`). Sourced from the
     /// `HIVE_FORGE_PUBLIC_URL` env var, which the c0re NixOS module
     /// sets from `services.hyperhive.swarm.forge.publicUrl` (defaults to
-    /// the gateway vhost URL when `deploy.forgejo.behindGateway = true`,
-    /// `null` otherwise). `None` when absent — the frontend **hides**
+    /// the gateway vhost URL). `None` when absent — the frontend **hides**
     /// forge links rather than guessing `http://<hostname>:3000`,
     /// which is only right by accident on deployments that aren't
     /// plain localhost.