forge: always behind the gateway; drop behindGateway

The forge always sits behind the gateway, so `deploy.forgejo.behindGateway`
(and its `swarm.forge.behindGateway` rename alias) is removed and its
true-branch behaviour is now unconditional within `deploy.forgejo.enable`:
https ROOT_URL on the gateway's httpsPort, the forge vhost and local DNS
name, the swarm-ui quick link, the published metrics scrape target, forgejo
metrics, the authelia `/metrics` rule, and `publicUrl` defaulting to
`https://<forge.domain>`.

Removed with it: the direct-port `http://<domain>:<httpPort>/` ROOT_URL
branch, the hive-ci assertion that the option is true, the core-toggle
cases that only exercised the false branch (the services-leaf case reads
`bare`, which never enabled the forge either). `hivectl open forge` now
points at `swarm.forge.publicUrl`, which can still be set to null.

Refs #4885

nix/host-modules/hive-c0re/environment.nix

@@ -210,8 +210,8 @@ in
   # breaks the moment the operator's browser hostname isn't the forge
   # host, e.g. through the gateway or a reverse proxy). Sourced from
   # `services.hyperhive.swarm.forge.publicUrl`, which itself defaults to the
-  # gateway vhost URL when `deploy.forgejo.behindGateway = true` and `null`
-  # otherwise — see that option's doc for the "hide, don't guess" rationale.
+  # gateway vhost URL — see that option's doc for the "hide, don't guess"
+  # rationale.
   # Absent here whenever `publicUrl` is `null`; the dashboard hides
   # forge links rather than emitting one it can't justify.
   HIVE_FORGE_PUBLIC_URL = config.services.hyperhive.swarm.forge.publicUrl;