wip(#2860): c0re-facing matrix.apiUrl option + HIVE_MATRIX_API_URL export

Nix half of the 4th layer mara found (47535: core cannot assume matrix
is on localhost). Rust half (matrix.rs MATRIX_HTTP) NOT done.

Parked here rather than left dirty: she has redirected me to jobq as
prio 1, and uncommitted files migrate across a checkout.

nix/host-modules/hive-matrix.nix

@@ -147,6 +147,37 @@ in
       '';
     };
 
+    apiUrl = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = if cfg.enable then "http://127.0.0.1:${toString cfg.httpPort}" else null;
+      defaultText = lib.literalExpression ''
+        if services.hyperhive.matrix.enable
+        then "http://127.0.0.1:''${toString services.hyperhive.matrix.httpPort}"
+        else null
+      '';
+      example = "https://matrix.example.com";
+      description = ''
+        Client-server API base URL **hive-c0re itself** uses to
+        provision matrix (register agent users, create the hive space
+        and chat room, invite members). Distinct from the agent-facing
+        `hyperhive.matrix.url`, which is the gateway vhost handed to
+        each agent's `hive-matrix-daemon`.
+
+        Defaults to the loopback listener **only when this module is the
+        thing running tuwunel** — in that case the address is not a
+        guess, it is where this module just put the container. Set it
+        explicitly (with `enable = false`) when the homeserver runs on
+        another machine; "everything on one host" is a special case of
+        the full deployment, not the assumption.
+
+        `null` means hive-c0re has no homeserver to provision against
+        and matrix provisioning no-ops. There is deliberately no
+        fallback compiled into the daemon: an address baked into the
+        binary is one that builds fine and then talks to the wrong
+        machine.
+      '';
+    };
+
     gatewayHost = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
       default = "matrix.${hyperhiveDomain}";