move the hive's vhosts and matrix discovery out of the gateway

The dashboard vhost, the hive domain vhost and the dashboard's local
name move to hive-c0re/vhosts.nix; the matrix .well-known discovery and
the legacy /matrix/ redirect move to glue-matrix-hive-discovery.nix,
which adds them to the hive domain vhost. Both declare through
gateway.vhosts. hive-gateway/vhosts.nix keeps the catch-all only, and
the gateway no longer reads deploy.matrix or c0re.servedFrontend, nor
deploy.hive-controller.enable for its vhosts.

Part of #3742.

nix/host-modules/glue-matrix-hive-discovery.nix

@@ -0,0 +1,81 @@
+# Glue: serve the swarm homeserver's discovery on the hive domain's vhost
+# wherever both run.
+#
+# ONE PAIRING PER FILE — matrix → hive domain vhost, and nothing else.
+# Deleting this leaves federation and clients with no `.well-known/matrix/*`
+# answer at the server name, and the legacy `<hive>/matrix/*` links 404.
+#
+# The locations sit on the hive domain because the matrix spec reads
+# delegation off the *server name*: it is the hive answering "where is my
+# homeserver", not the homeserver answering for itself (./hive-matrix.nix's
+# vhost on `gatewayHost` carries the rest).
+#
+# ⚠️ The condition repeats the one ./hive-c0re/vhosts.nix declares the hive
+# domain vhost under. With it looser, this file alone would declare that
+# vhost, with discovery and no `/` redirect.
+{
+  lib,
+  config,
+  ...
+}:
+let
+  hyperhiveCfg = config.services.hyperhive;
+  gatewayCfg = hyperhiveCfg.gateway;
+  matrixCfg = hyperhiveCfg.swarm.matrix;
+
+  publicPort = gatewayCfg.httpsPort;
+  # The canonical 443 elides the port; see `docs/networking/gateway.md`
+  # ("Self-signed TLS").
+  homeserverUrl = "https://${matrixCfg.gatewayHost}${
+    lib.optionalString (publicPort != 443) ":${toString publicPort}"
+  }";
+in
+{
+  config =
+    lib.mkIf
+      (
+        hyperhiveCfg.deploy.matrix.enable
+        && matrixCfg.gatewayHost != null
+        && hyperhiveCfg.deploy.hive-controller.enable
+        && gatewayCfg.enable
+        && hyperhiveCfg.swarm.dashboardDomain != null
+      )
+      {
+        services.hyperhive.gateway.vhosts.${hyperhiveCfg.domain}.locations = {
+          # `<hive>/matrix/*` → 301 → `gatewayHost`'s vhost/$1 (`chat.<swarm-domain>`
+          # by default; legacy deep-link shim for the fluffychat sub-domain).
+          # See `docs/networking/gateway.md`.
+          "/matrix/" = {
+            extraConfig = ''
+              rewrite ^/matrix/(.*)$ ${homeserverUrl}/$1 permanent;
+            '';
+          };
+
+          # `.well-known/matrix/{client,server}` discovery JSON, pointing
+          # clients and peers at `gatewayHost`: the homeserver has no other
+          # address. CORS `*` per matrix spec. See `docs/networking/gateway.md`.
+          "= /.well-known/matrix/client" = {
+            extraConfig = ''
+              default_type application/json;
+              ${gatewayCfg.lib.securityHeaders}
+              add_header Access-Control-Allow-Origin *;
+              return 200 '{"m.homeserver":{"base_url":"${homeserverUrl}"}}';
+            '';
+          };
+          # `m.server` is NOT a URL: per the matrix server-server spec
+          # (Resolving Server Names) a delegated host with NO port resolves
+          # to the federation default 8448 (after the SRV check) — the
+          # https-implies-443 rule does NOT apply here. So the port must be
+          # explicit even when it's the HTTPS default, unlike the client
+          # base_url above. Without it, peers federate to <gatewayHost>:8448
+          # (closed) while the endpoint actually lives on the gateway's 443
+          # vhost. See docs/networking/gateway.md discovery flow.
+          "= /.well-known/matrix/server" = {
+            extraConfig = ''
+              default_type application/json;
+              return 200 '{"m.server":"${matrixCfg.gatewayHost}:${toString publicPort}"}';
+            '';
+          };
+        };
+      };
+}