hive: stop controlling the swarm's forge and matrix containers

The forge and matrix are swarm services; per mara's ruling on #5475
(shape a) a hive no longer starts, stops or restarts them.

- hive-priv-sock: InfraContainer keeps only Gateway; InfraTarget goes,
  service_unit maps the gateway to nginx.service directly. A
  ControlInfraContainer naming Forge/Matrix fails to decode.
- hive-host-sock: LifecycleScope drops forge/matrix and refuses unknown
  fields, so an older hivectl's --forge is an error rather than an
  all-false scope meaning everything.
- hive-c0re: scoped_infra selects only the gateway.
- hivectl: --forge/--matrix removed from stop/start/restart.
- docs: services.md says how the forge and matrix are managed;
  security.md, coordinator.md and hivectl-cli.md follow.
- hive-host-sock, hivectl/power.rs: Stop and RestartScoped doc comments name the gateway (host nginx.service), not infra containers.

hivectl/src/power.rs

@@ -45,7 +45,7 @@ pub(crate) async fn start(
 /// issue tracker "dagify hivectl commands"). Each targeted agent rides
 /// exactly one atomic DAG queued up front — `Restart` (mechanical stop +
 /// reconcile), or `GracefulRestart` with `--graceful` (signal → drain →
-/// mechanical stop → reconcile); infra containers restart synchronously.
+/// mechanical stop → reconcile); the gateway (host `nginx.service`) restarts synchronously.
 /// No "submit one DAG, wait for it, submit another" composition on either
 /// side of the wire: unlike the old client-side stop-then-start compose, a
 /// dropped `hivectl` connection mid-restart no longer leaves an agent