gateway: service modules declare their vhost under gateway.vhosts

Ten service modules (forge, matrix chat, authelia, grafana, otel, nats,
swarm-ui, victorialogs, victoriametrics, bao UI) wrote
services.nginx.virtualHosts themselves, each applying the gateway's
listen set, per-name TLS attrs and security headers by hand. They now
declare services.hyperhive.gateway.vhosts.<name> with only their own
locations and options; ./declared-vhosts.nix renders it into the nginx
vhost with listen, TLS and headers added.

An eval assertion refuses a declared vhost that sets listen, addSSL,
onlySSL, enableACME, useACMEHost, sslCertificate or sslCertificateKey,
and one declared while the gateway is off. nats' own leaf is the new
`certificate` field. The rendered nginx vhosts are unchanged.

nix/host-modules/hive-gateway/default.nix

@@ -6,7 +6,8 @@
 # namespace of its own.
 # Full vhost map + discovery flow + design rationale in
 # `docs/networking/gateway.md`. Layout: ./options.nix (option declarations),
-# ./vhosts.nix (the nginx virtual-host tree), ./error-pages.nix
+# ./vhosts.nix (the gateway's own nginx virtual hosts), ./declared-vhosts.nix
+# (renders the vhosts service modules declare under `gateway.vhosts`), ./error-pages.nix
 # (styled static pages), ./dns.nix + ./dnsmasq.nix (the resolver, which
 # has an enable of its own because a host can need hive names to resolve
 # without serving a vhost).
@@ -134,6 +135,7 @@ in
   imports = [
     ./options.nix
     ./dns.nix
+    ./declared-vhosts.nix
   ];
 
   config = lib.mkIf cfg.enable {