fix: forge URL + firewall for isolateContainers=true

When containers run in private netns (isolateContainers=true), host
loopback is unreachable so HIVE_FORGE_URL=http://127.0.0.1:3000 breaks.

- nix/modules/hive-network.nix: when isolateContainers is on + forge
  is enabled, open forge.httpPort on the bridge interface so agents
  can reach forgejo at bridgeIp:httpPort (forgejo binds 0.0.0.0)
- nix/modules/hive-c0re.nix: HIVE_FORGE_URL switches to bridge IP
  when network.enable && isolateContainers; loopback path retained
  when isolateContainers=false
- docs/network.md: add Forge access + Forge URL rows to effects table
- docs/gateway.md: rewrite HIVE_FORGE_URL section for both modes

nix/modules/hive-network.nix

@@ -215,6 +215,17 @@ in
         ip saddr ${cfg.bridgeIp}/${toString cfg.bridgePrefixLength} ip daddr 127.0.0.0/8 drop
       '';
 
+      # Allow isolated agents to reach the forge via the bridge gateway IP.
+      # Forgejo binds 0.0.0.0 so it's reachable at `bridgeIp:httpPort` from
+      # inside agent containers; without this rule the default INPUT policy
+      # drops the connection before it reaches forgejo. Only added when forge
+      # is enabled — no-op otherwise.
+      networking.firewall.interfaces.${cfg.bridgeName}.allowedTCPPorts =
+        lib.optionals config.services.hyperhive.forge.enable
+          [
+            config.services.hyperhive.forge.httpPort
+          ];
+
       # Tells hive-c0re to pass PRIVATE_NETWORK + bridge settings to each
       # container. HIVE_NETWORK_SUBNET is host-bridge IP/prefix, not canonical
       # network address — the Rust side normalises before subnet arithmetic.