wip(#2860): c0re-facing matrix.apiUrl option + HIVE_MATRIX_API_URL export

Nix half of the 4th layer mara found (47535: core cannot assume matrix
is on localhost). Rust half (matrix.rs MATRIX_HTTP) NOT done.

Parked here rather than left dirty: she has redirected me to jobq as
prio 1, and uncommitted files migrate across a checkout.

nix/host-modules/hive-c0re/environment.nix

@@ -119,6 +119,20 @@ in
       # at.
       HIVE_MATRIX_URL = "http://${config.services.hyperhive.matrix.gatewayHost}";
     }
+// lib.optionalAttrs (config.services.hyperhive.matrix.apiUrl != null) {
+  # Client-server API base hive-c0re uses to provision matrix (register
+  # agent users, create the hive space + chat room, invite members).
+  # Supplied by `services.hyperhive.matrix.apiUrl`, which the matrix
+  # module fills in with its own loopback listener when it is the thing
+  # running tuwunel — and which the operator sets by hand when the
+  # homeserver lives on another machine.
+  #
+  # NOT the agent-facing HIVE_MATRIX_URL above: that one is the gateway
+  # vhost, and it is absent whenever there is no vhost. Reusing it here
+  # would silently stop provisioning on a hive that runs matrix without
+  # one.
+  HIVE_MATRIX_API_URL = config.services.hyperhive.matrix.apiUrl;
+}
 // lib.optionalAttrs config.services.hyperhive.matrix.gui.enable {
   # Availability flags read by the dashboard's `/api/state`.
   # Matrix GUI lives entirely on the gateway nginx (matrix tab

nix/host-modules/hive-matrix.nix

@@ -147,6 +147,37 @@ in
       '';
     };
 
+    apiUrl = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = if cfg.enable then "http://127.0.0.1:${toString cfg.httpPort}" else null;
+      defaultText = lib.literalExpression ''
+        if services.hyperhive.matrix.enable
+        then "http://127.0.0.1:''${toString services.hyperhive.matrix.httpPort}"
+        else null
+      '';
+      example = "https://matrix.example.com";
+      description = ''
+        Client-server API base URL **hive-c0re itself** uses to
+        provision matrix (register agent users, create the hive space
+        and chat room, invite members). Distinct from the agent-facing
+        `hyperhive.matrix.url`, which is the gateway vhost handed to
+        each agent's `hive-matrix-daemon`.
+
+        Defaults to the loopback listener **only when this module is the
+        thing running tuwunel** — in that case the address is not a
+        guess, it is where this module just put the container. Set it
+        explicitly (with `enable = false`) when the homeserver runs on
+        another machine; "everything on one host" is a special case of
+        the full deployment, not the assumption.
+
+        `null` means hive-c0re has no homeserver to provision against
+        and matrix provisioning no-ops. There is deliberately no
+        fallback compiled into the daemon: an address baked into the
+        binary is one that builds fine and then talks to the wrong
+        machine.
+      '';
+    };
+
     gatewayHost = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
       default = "matrix.${hyperhiveDomain}";