swarm-controller: serve swarm-wide service quick links (hyperhive#3289)

New `services.hyperhive.swarm.controller.links` option (listOf {label,
icon, url}, same shape as the per-agent hyperhive.dashboardLinks) plus
a new GET /api/links route serving it, same pattern as the existing
hives/GET /api/hives.

Rather than one central hardcoded list, each service's own module
contributes its own entry when actually enabled on the controller's
host: swarm-authelia.nix, hive-matrix.nix (gated on gui.enable too,
since / on that vhost only serves fluffychat then) and
hive-forge/default.nix (gated on behindGateway) each push one entry,
the same list-merge idiom services.hyperhive.gateway.localNames
already uses. swarm-ui.nix contributes a static entry for its own
same-origin swagger docs. Adding a future service's link is a nix-only
change to that service's own module.

Verified: cargo build/clippy/test -p swarm-controller clean, a
throwaway nixosSystem eval confirms all 4 entries merge correctly into
SWARM_CONTROLLER_LINKS, nix build .#swarm-controller succeeds.

nix/host-modules/hive-matrix.nix

@@ -508,6 +508,20 @@ in
     # every clause below carries that guard.
     services.hyperhive.gateway.localNames = lib.optional (cfg.gatewayHost != null) cfg.gatewayHost;
 
+    # This swarm-ui quick-links entry. Gated on `gui.enable` too, not just
+    # `gatewayHost != null`: `/` on that vhost only serves fluffychat
+    # (below) when the GUI is on — otherwise the link would 404, the same
+    # reason the old dashboard's H0M3 page hides its Matrix tile on
+    # `state.matrix_gui_enabled` rather than `gatewayHost` alone. See
+    # `services.hyperhive.swarm.controller.links`'s description.
+    services.hyperhive.swarm.controller.links =
+      lib.optional (cfg.gatewayHost != null && cfg.gui.enable)
+        {
+          label = "Matrix";
+          icon = "💬";
+          url = "https://${cfg.gatewayHost}/";
+        };
+
     # Accept-header SPA map, used only by the `/` location below (see
     # docs/gateway.md "SPA fallback"): text/html → index.html, else a
     # sentinel so `try_files` falls through to 404. `appendHttpConfig`