nix: give the gateway, resolver and bridge their own enable

`services.hyperhive.gateway.enable`, `gateway.dns.enable` and
`network.enable` replace the `hyperhive.enable` gate on all three. Each
defaults to false; the modules that need one assert it with `mkDefault
true` from inside the guard their own deployment already carries, and
`swarm-required-services.nix` — the module that owns what the
swarm-services toggle implies — asserts all three explicitly.

hive-c0re asserts all three unconditionally, so an ordinary hive keeps
getting them with no opt-in: it is the host's only knowledge that agent
containers exist.

The resolver moves to its own `hive-gateway/dns.nix` so it can be gated
without reindenting the nginx half of the module.

Reinstates `network.enable`, dropping its `mkRemovedOptionModule` shim.
A config still carrying `network.enable = false` from before the removal
now switches the bridge off instead of failing eval.

Also deletes a duplicate `centralToggleOff` fixture in nix/module-eval.nix.
Two sibling slices added it independently (c5f60fd5, ce3b3d94); the merge
was textually clean and left `main` failing to evaluate at all, so this
file could not be gated without removing one.

nix/host-modules/hive-gateway/dns.nix

@@ -0,0 +1,63 @@
+# The hive's dnsmasq resolver. Split out of ./default.nix because it has
+# its own enable: a host can need hive names to resolve without serving a
+# single vhost. Option declared in ./options.nix, config rendered by
+# ./dnsmasq.nix.
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.services.hyperhive.gateway;
+  networkCfg = config.services.hyperhive.network;
+  hyperhiveDomain = config.services.hyperhive.domain;
+in
+{
+  config = lib.mkIf cfg.dns.enable {
+    # dnsmasq is a host service alongside nginx, so it reads the host's
+    # /etc/resolv.conf directly and picks up network changes as they
+    # happen — no copy to keep in sync.
+    services.dnsmasq = import ./dnsmasq.nix {
+      inherit
+        lib
+        cfg
+        networkCfg
+        hyperhiveDomain
+        ;
+    };
+
+    # dnsmasq binds the bridge interface and answers with the bridge
+    # address, so the resolver is itself a consumer one layer down.
+    services.hyperhive.network.enable = lib.mkDefault true;
+
+    # A name that stops resolving presents as every client timing out at
+    # once, so this unit's journal is worth reading swarm-wide.
+    services.hyperhive.swarm.otel.journaldUnits = [ "dnsmasq" ];
+
+    # The host asks the hive's own resolver, at the BRIDGE IP.
+    #
+    # Every container inherits a COPY of this host's `/etc/resolv.conf`
+    # at start (`nixos-containers.nix`: `cp --remove-destination`, one
+    # shot, not a bind-mount) — so whatever address is written here is
+    # the address every container will try, in its own netns.
+    #
+    # 🚨 That is why this is the bridge IP and not `127.0.0.1`, and the
+    # distinction is load-bearing rather than stylistic:
+    #
+    #   value       host   host-netns containers   bridged containers
+    #   127.0.0.1    ok            ok               THEIR OWN loopback
+    #   bridge IP    ok            ok                      ok
+    #
+    # dnsmasq binds both `lo` and the bridge (./dnsmasq.nix), so the
+    # bridge IP is reachable from the host too — it is the only value
+    # correct on both sides of a netns boundary. `resolveLocalQueries`
+    # publishes loopback by default, hence both overrides here; the
+    # flag stays on for its `resolv-file` plumbing, which is what keeps
+    # dnsmasq's own upstreams out of the file we are pointing at it.
+    #
+    # Cost, stated because it is real: the host's DNS now depends on
+    # dnsmasq being up. Every container already did.
+    networking.nameservers = lib.mkForce [ networkCfg.bridgeIp ];
+    networking.resolvconf.useLocalResolver = lib.mkForce false;
+  };
+}