fix: forge URL + firewall for isolateContainers=true

When containers run in private netns (isolateContainers=true), host
loopback is unreachable so HIVE_FORGE_URL=http://127.0.0.1:3000 breaks.

- nix/modules/hive-network.nix: when isolateContainers is on + forge
  is enabled, open forge.httpPort on the bridge interface so agents
  can reach forgejo at bridgeIp:httpPort (forgejo binds 0.0.0.0)
- nix/modules/hive-c0re.nix: HIVE_FORGE_URL switches to bridge IP
  when network.enable && isolateContainers; loopback path retained
  when isolateContainers=false
- docs/network.md: add Forge access + Forge URL rows to effects table
- docs/gateway.md: rewrite HIVE_FORGE_URL section for both modes

docs/network.md

@@ -108,6 +108,8 @@ agent containers from shared host netns to private netns. Set only after
 | IP forwarding | `boot.kernel.sysctl."net.ipv4.ip_forward" = 1` |
 | Internet NAT | `networking.nat { enable = true; internalInterfaces = [ bridgeName ]; }` — MASQUERADE on packets leaving via any external NIC |
 | Loopback DROP | `networking.firewall.extraInputRules` — drops bridge-subnet → `127.0.0.0/8` traffic; defence-in-depth against routing table leaks |
+| Forge access | `networking.firewall.interfaces.<bridge>.allowedTCPPorts` — opens `forge.httpPort` on the bridge interface so isolated agents can reach forgejo at `<bridgeIp>:<httpPort>` |
+| Forge URL | `HIVE_FORGE_URL` flips from `http://127.0.0.1:3000` to `http://<bridgeIp>:3000` — forwarded to containers via meta flake |
 | c0re signal | `HIVE_NETWORK_ISOLATION=1`, `HIVE_NETWORK_BRIDGE`, `HIVE_NETWORK_SUBNET` in `systemd.services.hive-c0re.environment` |
 
 `HIVE_NETWORK_SUBNET` is the host-side bridge IP + prefix (e.g.