refactor(3202): the gateway publishes its vhost construction kit

Slice 1 of #3202. The listen set, the per-name TLS attrs and the
security headers move out of vhosts.nix into ./vhost-lib.nix and are
published as `services.hyperhive.gateway.lib` (internal, readOnly).

No behaviour change: vhosts.nix consumes the published value, so the
rendered vhost tree is identical.

The point is the next slice. Today a swarm service's vhost lives in
the gateway because only the gateway knows the port pair, the issuer
for a name, and the header block. Publishing those three is what lets
a service module declare its own vhost without the gateway having to
know that service by name.

nix/host-modules/hive-gateway/default.nix

@@ -65,7 +65,25 @@ let
   svcCert = "${tlsDir}/swarm-services.pem";
   svcKey = "${tlsDir}/swarm-services-key.pem";
 
+  # The vhost construction kit (listen set / per-name TLS attrs /
+  # security headers). Computed here, published as `cfg.lib` below, and
+  # handed to ./vhosts.nix **as the published value** — so the tree the
+  # gateway renders and the kit a service module gets are the same
+  # object by construction, not by two call sites agreeing.
+  vhostLib = import ./vhost-lib.nix {
+    inherit
+      lib
+      cfg
+      tlsCert
+      tlsKey
+      svcCert
+      svcKey
+      swarmServiceDomains
+      ;
+  };
+
   nginxTree = import ./vhosts.nix {
+    gwLib = cfg.lib;
     inherit
       lib
       cfg
@@ -77,11 +95,6 @@ let
       hyperhiveDomain
       dashboardDist
       swaggerUiTheme
-      tlsCert
-      tlsKey
-      svcCert
-      svcKey
-      swarmServiceDomains
       ;
     errorPages = import ./error-pages.nix { inherit pkgs; };
   };
@@ -90,6 +103,12 @@ in
   imports = [ ./options.nix ];
 
   config = lib.mkIf config.services.hyperhive.enable {
+    # Publish the kit. Defined here rather than as an option `default`
+    # so it stays a plain value computed once from resolved cert paths —
+    # `tlsFor` closes over `svcCert`/`svcKey`, which are derived in this
+    # file's `let` and are not option surface.
+    services.hyperhive.gateway.lib = vhostLib;
+
     assertions = [
       {
         assertion = !(cfg.tls.acme.enable && cfg.tls.certDir != null);