hive: stop controlling the swarm's forge and matrix containers

The forge and matrix are swarm services; per mara's ruling on #5475
(shape a) a hive no longer starts, stops or restarts them.

- hive-priv-sock: InfraContainer keeps only Gateway; InfraTarget goes,
  service_unit maps the gateway to nginx.service directly. A
  ControlInfraContainer naming Forge/Matrix fails to decode.
- hive-host-sock: LifecycleScope drops forge/matrix and refuses unknown
  fields, so an older hivectl's --forge is an error rather than an
  all-false scope meaning everything.
- hive-c0re: scoped_infra selects only the gateway.
- hivectl: --forge/--matrix removed from stop/start/restart.
- docs: services.md says how the forge and matrix are managed;
  security.md, coordinator.md and hivectl-cli.md follow.
- hive-host-sock, hivectl/power.rs: Stop and RestartScoped doc comments name the gateway (host nginx.service), not infra containers.

hive-c0re/src/priv_client.rs

@@ -363,13 +363,12 @@ pub async fn set_agent_paused(agent_name: &str, paused: bool) -> Result<()> {
     .await?)
 }
 
-/// Start / stop a hive infrastructure service (`hive-gateway`, `hive-forge`,
-/// `hive-matrix`) on the host via `systemctl <action> <unit>`,
-/// where the unit is derived root-side from the variant
-/// (`container@<name>.service`, or `nginx.service` for the gateway). The
-/// [`InfraContainer`] enum is the allowlist — hive-priv needs no name
-/// re-validation. Used by the hive-wide `hivectl stop` / `start` flow and
-/// the dashboard's operator-only infra panel. No agent-facing path exists.
+/// Start / stop a hive infrastructure service (`hive-gateway`) on the host
+/// via `systemctl <action> <unit>`, where the unit is derived root-side from
+/// the variant (`nginx.service` for the gateway). The [`InfraContainer`]
+/// enum is the allowlist — hive-priv needs no name re-validation. Used by
+/// the hive-wide `hivectl stop` / `start` / `restart` flow. No agent-facing
+/// path exists.
 pub async fn control_infra_container(container: InfraContainer, action: InfraAction) -> Result<()> {
     ok(call(&PrivRequest::ControlInfraContainer { container, action }).await?)
 }