hive-forge: resolve through the hive's dnsmasq

The forge container used the host's resolvers, where the swarm domain has
no records — so every outbound call to a swarm name failed with "no such
host". Forgejo's webhook deliveries died there: knowledge, config-pr and
vcs-activity alike, which is why the swarm-controller's receiver has never
logged a verified delivery and knowledge propagation has been running on
its hourly fallback.

An earlier fix taught the container authelia's name with a `networking.hosts`
entry. That covered one name and left the rest, so use the resolver every
other service container already uses and drop the override — hive-matrix
records why a second answer that can disagree with the first is worse than
none.

Closes #3824

nix/host-modules/hive-matrix.nix

@@ -752,14 +752,12 @@ in
       '';
     };
 
-    # ⚠️ Deliberately NO `networking.hosts` entry for authelia's name, and
-    # the difference from hive-forge (which needs one) is worth stating:
-    # that container resolves through the host's resolvers, where the swarm
-    # domain has no records. This one resolves through the hive's dnsmasq
-    # at `bridgeIp` (see the static resolv.conf below), and every
-    # `gateway.localNames` entry — authelia's domain among them — is
-    # already mapped there. Adding a loopback override would only create a
-    # second answer that can disagree with the first.
+    # ⚠️ Deliberately NO `networking.hosts` entry for authelia's name. This
+    # container resolves through the hive's dnsmasq at `bridgeIp` (see the
+    # static resolv.conf below), and every `gateway.localNames` entry —
+    # authelia's domain among them — is already mapped there. Adding a
+    # loopback override would only create a second answer that can
+    # disagree with the first.
 
     # Activation-time token generation — without this the bind-mount
     # would hand tuwunel an empty file on first boot and break every