docs(3191): drop the migration history from the gateway comments

Per mara on the PR: how a thing used to be deployed stops being
relevant the moment this is merged and the hives are rebuilt, so the
comments state the current constraint and nothing about the container
that used to hold it.

Removes the two ⚠️ blocks this PR added (hive-tls-ca's ordering, the
resign propagation), the matrix ordering's, dnsmasq's resolv.conf
paragraph, and the pre-existing 'REMOVED WITH THE CONTAINER' inventory
in the gateway module. The 🚨 do-not-simplify warning on the cert-copy
unit keeps both its reasons and loses the container framing.

Kept deliberately: the two operator-facing 'this used to default to
true' option notes (migration information for someone upgrading), and
the SupplementaryGroups block, which documents why an absence is
load-bearing rather than how a deployment used to look.

nix/host-modules/hive-gateway/default.nix

@@ -155,32 +155,6 @@ in
       "f /var/lib/hive-gateway/conf/gateway.htpasswd 0644 hive-core hive-core - -"
     ];
 
-    # ⚠️ REMOVED WITH THE CONTAINER, and each one was a workaround for the
-    # boundary rather than a thing nginx or dnsmasq needed:
-    #
-    # - `privateNetwork = false` — the container already shared the host
-    #   netns, which is why nginx bound host ports and `localhost`
-    #   upstreams reached hive-c0re. On the host that is simply true.
-    # - `additionalCapabilities = [ "CAP_NET_ADMIN" ]` — dnsmasq refuses
-    #   to start with a `dhcp-range` unless it holds NET_ADMIN, and
-    #   nspawn's bounding set dropped it for a host-netns container.
-    #   Host root has it.
-    # - `networking.firewall.enable = false` — a container sharing the
-    #   host netns would run *its* firewall.service against the HOST
-    #   ruleset, flushing nixos-fw and deleting the nixos-nat-* chains on
-    #   every boot. With one machine there is one firewall (below).
-    # - `networking.resolvconf.enable = false` + the `hive-gateway-resolv`
-    #   path/service pair — the container's /etc/resolv.conf was a
-    #   one-shot copy frozen at start, so a host network change left
-    #   dnsmasq forwarding to a resolver that was gone. The whole
-    #   watch-copy-reload machine existed to bridge two files. There is
-    #   now one.
-    # - three bind mounts — /run/hive-agent, /run/hive-state, and either
-    #   /run/hive-tls (operator cert) or /run/hive-ca (self-signed);
-    #   those last two are mutually exclusive mkIfs, so it was never
-    #   four. All plain host paths now.
-    #
-    # See `docs/network.md::Resolver behaviour` for the resolver history.
     # ACME (Let's Encrypt) integration. nginx vhosts set
     # `enableACME = true` via the vhost builder; this provides the
     # shared ACME config (acceptTerms + email).
@@ -191,15 +165,14 @@ in
 
     # Import the hive-CA leaf into nginx's state dir before nginx starts.
     #
-    # 🚨 THIS LOOKS LIKE A LEFTOVER OF THE CONTAINER AND IS NOT — do not
-    # "simplify" it into pointing nginx at the CA dir. It does TWO jobs:
+    # 🚨 DO NOT "simplify" this into pointing nginx at the CA dir. It
+    # does TWO jobs:
     #
     # (1) It re-modes the leaf. `hive-tls-ca` writes the key 0600
     #     root:root; nginx's pre-start `nginx -t` runs as the nginx
     #     *user*, so a 0600 key fails the config test with
     #     `BIO_new_file() … Permission denied` and blocks the unit —
-    #     hence the 0640 root:nginx copy below. That is a file-mode fact,
-    #     not a namespace one, and it did not go away with the container.
+    #     hence the 0640 root:nginx copy below.
     # (2) It guarantees that **every cert path the nginx config names
     #     exists** — which is what the swarm-services fallback at the
     #     bottom of the script is for. nginx refuses to load a config

nix/host-modules/hive-gateway/dnsmasq.nix

@@ -69,11 +69,8 @@
     dhcp-leasefile = "/var/lib/dnsmasq/dnsmasq.leases";
     # No explicit upstream: non-hive queries follow dnsmasq's
     # resolv.conf default — the host's own `/etc/resolv.conf`, so the
-    # hive always uses the host's resolvers and follows them live. This
-    # used to be a *copy* nixos-container made at container start, kept
-    # fresh by a host-side path unit that pushed in a new one and
-    # reloaded dnsmasq; running on the host deleted both the copy and
-    # the machinery that watched it. Deliberately no fallback
+    # hive always uses the host's resolvers and follows them live with
+    # no copy to go stale. Deliberately no fallback
     # `server=`: dnsmasq queries
     # all known upstreams in parallel, so a hardcoded public resolver
     # would take a share of *normal* traffic, not just fill in when the