nix: give the gateway, resolver and bridge their own enable

`services.hyperhive.gateway.enable`, `gateway.dns.enable` and
`network.enable` replace the `hyperhive.enable` gate on all three. Each
defaults to false; the modules that need one assert it with `mkDefault
true` from inside the guard their own deployment already carries, and
`swarm-required-services.nix` — the module that owns what the
swarm-services toggle implies — asserts all three explicitly.

hive-c0re asserts all three unconditionally, so an ordinary hive keeps
getting them with no opt-in: it is the host's only knowledge that agent
containers exist.

The resolver moves to its own `hive-gateway/dns.nix` so it can be gated
without reindenting the nginx half of the module.

Reinstates `network.enable`, dropping its `mkRemovedOptionModule` shim.
A config still carrying `network.enable = false` from before the removal
now switches the bridge off instead of failing eval.

Also deletes a duplicate `centralToggleOff` fixture in nix/module-eval.nix.
Two sibling slices added it independently (c5f60fd5, ce3b3d94); the merge
was textually clean and left `main` failing to evaluate at all, so this
file could not be gated without removing one.

nix/host-modules/hive-ci.nix

@@ -177,6 +177,13 @@ in
     # name follows that attr rather than `cfg.name`.
     services.hyperhive.swarm.otel.journaldUnits = [ "gitea-runner-hive" ];
 
+    # The runner container has a private netns of its own, so it is
+    # attached to the bridge and reaches the forge by name through the
+    # gateway vhost the assertion above already insists on.
+    services.hyperhive.network.enable = lib.mkDefault true;
+    services.hyperhive.gateway.enable = lib.mkDefault true;
+    services.hyperhive.gateway.dns.enable = lib.mkDefault true;
+
     # Create /run/hive-ci/ on the host and seed runner-token with a
     # placeholder. The container bind-mounts this file read-only; hive-c0re
     # (via hive-priv's RegisterCiRunner) overwrites it with the real