feat(#2014): hivectl open verb + Urls host request for web surfaces

docs/tools/hivectl.md

@@ -151,3 +151,29 @@ lands in a faithful copy of the agent's environment:
   the hyperhive/matrix MCP tools (which `--continue` needs to replay a
   tool-using history), and the role prompt. Each flag is included only
   when its file exists.
+
+## Open
+
+Print (and best-effort open in a browser) one of the hive's web surfaces.
+Requires the `hive-c0re` daemon to be running.
+
+```bash
+hivectl open            # operator dashboard (same as `open home`)
+hivectl open home       # operator dashboard (https://<domain>/)
+hivectl open forge      # the forge (Forgejo) web UI
+hivectl open matrix     # the matrix GUI (fluffychat)
+```
+
+The URL is resolved from the running daemon (`HostRequest::Urls`), which
+reads the per-surface public URLs from c0re's service env — so custom
+forge / matrix domains resolve correctly instead of assuming
+`forge.<domain>`. The URL is **always printed** (the reliable core, since
+the host is usually headless / driven over SSH), then `xdg-open` is tried
+as a convenience — a missing or failing opener is reported as a note, not
+an error.
+
+A surface has no URL when it isn't browser-reachable: `home` needs
+`services.hyperhive.domain`; `forge` needs
+`services.hyperhive.forge.behindGateway = true`; `matrix` needs
+`services.hyperhive.matrix.gui.enable = true`. In those cases the command
+exits with a hint naming the option to set.