fix(#2860): hive-c0re stops assuming matrix is on localhost

`MATRIX_HTTP` was `http://localhost:8008`, compiled in, used at 18 call
sites. That address is right only while the homeserver happens to share
this daemon's netns, and its doc comment asserted exactly that as a
general fact. A hive whose homeserver lives anywhere else builds fine
and then talks to the wrong machine.

It now reads `HIVE_MATRIX_API_URL`, which `hive-c0re.nix` sets from
`hyperhive.matrix.apiUrl`. The matrix module fills that in with its own
loopback listener when it is the thing running tuwunel — there it is not
a guess but a fact about what it just started — and the operator sets it
by hand otherwise. There is no compiled-in fallback, for the same reason
`forge_http_base()` has none.

`is_present()` follows. It used to scan `nixos-container list` for
`hive-matrix`, which answers "is the homeserver a container on this
host" — a different question, and the reason a remote homeserver would
silently no-op no matter how it was addressed. It now asks whether a URL
is configured. A co-located hive is unaffected: the module supplies the
loopback URL whenever it runs tuwunel itself. It also stops being
`async`, since it no longer does IO, and `require_matrix_present`'s
message names both ways to have a homeserver rather than only the local
container.

Absent a URL, every matrix path no-ops exactly as it did with no
container, and the two accessors make that structural: `Option` for the
callers that fall back to `None`, a `Result` flavour naming the skipped
`is_present()` gate for the ones that propagate.

hive-c0re/src/server.rs

@@ -463,13 +463,19 @@ async fn handle_set_resource_limits(
     )]))
 }
 
-/// Guard: matrix provisioning needs the homeserver container running.
-async fn require_matrix_present() -> Result<()> {
-    if crate::matrix::is_present().await {
+/// Guard: matrix provisioning needs a homeserver to provision against.
+///
+/// Answers "is one configured", not "is one running here" — the message names
+/// both ways to get there, since a hive that talks to someone else's
+/// homeserver never enables the local container at all.
+fn require_matrix_present() -> Result<()> {
+    if crate::matrix::is_present() {
         return Ok(());
     }
     anyhow::bail!(
-        "hive-matrix container not running — start it (services.hyperhive.matrix.enable = true) before provisioning matrix users"
+        "no matrix homeserver configured — set services.hyperhive.matrix.enable = true to run one \
+         here, or services.hyperhive.matrix.apiUrl to point at an existing one, before \
+         provisioning matrix users"
     )
 }
 
@@ -477,7 +483,7 @@ async fn handle_matrix_create_user(
     name: &hive_types::Ident,
     password: Option<&str>,
 ) -> Result<HostResponse> {
-    require_matrix_present().await?;
+    require_matrix_present()?;
     let register_token =
         crate::matrix::ensure_register_token().context("read matrix register token")?;
     let client = matrix_http_client()?;
@@ -689,7 +695,7 @@ async fn handle_push_snapshot(
 }
 
 async fn handle_matrix_sync_admin() -> Result<HostResponse> {
-    require_matrix_present().await?;
+    require_matrix_present()?;
     let register_token =
         crate::matrix::ensure_register_token().context("read matrix register token")?;
     let client = matrix_http_client()?;
@@ -707,7 +713,7 @@ async fn handle_matrix_sync_admin() -> Result<HostResponse> {
 }
 
 async fn handle_matrix_promote_user(name: &str) -> Result<HostResponse> {
-    require_matrix_present().await?;
+    require_matrix_present()?;
     let admin_token = crate::matrix::read_admin_token()?;
     let client = matrix_http_client()?;
     let server_name = crate::matrix::discover_server_name(&client)
@@ -722,7 +728,7 @@ async fn handle_matrix_promote_user(name: &str) -> Result<HostResponse> {
 }
 
 async fn handle_matrix_invite(user: &str, room: Option<&str>) -> Result<HostResponse> {
-    require_matrix_present().await?;
+    require_matrix_present()?;
     let admin_token = crate::matrix::read_admin_token()?;
     let client = matrix_http_client()?;
     let server_name = crate::matrix::discover_server_name(&client)
@@ -742,7 +748,7 @@ async fn handle_matrix_invite(user: &str, room: Option<&str>) -> Result<HostResp
 }
 
 async fn handle_matrix_reset_password(name: &str) -> Result<HostResponse> {
-    require_matrix_present().await?;
+    require_matrix_present()?;
     let admin_token = crate::matrix::read_admin_token()?;
     let client = matrix_http_client()?;
     let server_name = crate::matrix::discover_server_name(&client)