nix/hive-{matrix,gateway}: host fluffychat at matrix.<hive>/, 301 from <hive>/matrix/ (#772)

mara on #764:9897: "host the fluffy chat app at / as follow up?"

Moves fluffychat-web from the bare-domain sub-path
(`<hive>/matrix/`) to the matrix sub-domain root
(`matrix.<hive>/`). Follow-up to #764 (matrix vhost itself), per
mara's gateway-architecture verdict (sub-domain for external standard
apps, sub-path for hyperhive-internal). Stacked on
`atlas/747-matrix-behind-gateway` — depends on #764 landing first.

## Mechanics

**hive-matrix.nix:**
- Drop `flutterBuildFlags = [ "--base-href" "/matrix/" ]` from
  `fluffychat-web-fixed`. Upstream default `--base-href "/"` is correct
  at sub-domain root.
- Update option docs to reflect new mount point.

**hive-gateway.nix:**
- `$matrix_spa_target` map target flips from `/matrix/index.html` →
  `/index.html` (sub-domain root now).
- New `<hive>/matrix/*` location: `rewrite ^/matrix/(.*)$
  matrix.<hive>/$1 permanent;` — 301 redirect preserves bookmark +
  deep-link compatibility for `<hive>/matrix/#/rooms/...` URLs during
  the transition.
- `<hive>/matrix/config.json` location removed (moved to `/config.json`
  on the matrix vhost).
- Matrix vhost (#764) gains `/` location: serves fluffychat dist as
  static files with the Accept-header SPA fallback (`/_matrix/`
  proxying to tuwunel keeps working via nginx longer-prefix-wins
  precedence). When `gui.enable = false`, `/` returns 404 cleanly.
- Matrix vhost gains `= /config.json` for the FluffyChat boot-config
  pre-fill (#736).

## Verified

```
vhosts:        ["_", "forge.test.local", "matrix.test.local"]
bare locations: ["/", "/matrix/", "= /.well-known/matrix/client",
                 "= /.well-known/matrix/server"]
matrix vhost locations: ["/", "/_matrix/", "= /config.json"]
/matrix/ extraConfig: "rewrite ^/matrix/(.*)$ http://matrix.test.local/$1 permanent;"
matrix vhost / alias: /nix/store/...fluffychat-web-2.6.0/
```

Full container toplevel builds clean.

## Risk

Medium. Two breaking changes for operators:

1. **Bookmark migration**: `http://<hive>/matrix/#/rooms/...` 301s
   to `http://matrix.<hive>/#/rooms/...`. Browser bookmarks +
   shared links keep working via the redirect; can be cleaned up
   once it's been in the wild long enough.

2. **fluffychat-web dist hash changes**: dropping the
   `--base-href "/matrix/"` flag changes the derivation hash, so
   `gui.package` rebuilds even though the source is the same.
   Operators on substitute caches will fetch the new dist; building
   from source takes the same time as before.

The `.well-known/matrix/{client,server}` delegation (already
advertising `matrix.<hive>` per #764) means matrix clients
auto-discover the new location — no client config change needed.

## Sequencing

**Depends on #764** — needs the matrix vhost to host the new `/`
location. Merge after #764 lands + soaks. If #764 changes shape
during review I'll rebase + force-push.

Closes #772.

nix/modules/hive-matrix.nix

@@ -103,17 +103,14 @@ let
   };
 
   # `pkgs.fluffychat-web` with #685's three missing files patched
-  # in via postInstall, plus the existing `--base-href "/matrix/"`
-  # override (#634) for the sub-path mount.
+  # in via postInstall. No `--base-href` override anymore (#772 moves
+  # fluffychat from the bare-domain `<hive>/matrix/` sub-path to the
+  # `matrix.<hive>/` sub-domain root; upstream's default `--base-href
+  # "/"` is correct at sub-domain root). The previous `/matrix/`
+  # override from #634 + #754 (forge sub-domain pattern) lived here
+  # until the matrix sub-domain vhost in #764 made the sub-path
+  # redundant.
   fluffychat-web-fixed = pkgs.fluffychat-web.overrideAttrs (old: {
-    # `--base-href "/matrix/"` so relative asset paths resolve
-    # under the sub-path mount (#634). Upstream default is `/`,
-    # wrong for hyperhive's `/matrix/` location.
-    flutterBuildFlags = (old.flutterBuildFlags or [ ]) ++ [
-      "--base-href"
-      "/matrix/"
-    ];
-
     # `dart` from the flutter341 closure (already pulled, no
     # incremental closure cost) so we can compile the web-worker
     # entry point that buildFlutterApplication skips.
@@ -385,21 +382,22 @@ in
         defaultText = lib.literalExpression "config.services.hyperhive.matrix.enable";
         description = ''
           Serve a matrix web client (default `pkgs.fluffychat-web`) as
-          a static dist at `/matrix/` via the hive-gateway nginx
-          (#607 / #634). Defaults to whatever
+          a static dist at the root of the matrix sub-domain vhost
+          (`matrix.''${services.hyperhive.domain}/`, via the hive-gateway
+          nginx — #607 / #634 / #772). Defaults to whatever
           `services.hyperhive.matrix.enable` is — turning on the
           homeserver gives you the web client by default; set to
-          `false` explicitly to opt out of the GUI while keeping
-          the homeserver running for agents. Requires
-          `services.hyperhive.gateway.enable` (default on); when
-          gateway is off no one hosts the GUI and the
-          `M4TR1X →` dashboard tab is hidden.
+          `false` explicitly to opt out of the GUI while keeping the
+          homeserver running for agents. Requires
+          `services.hyperhive.gateway.enable` (default on) +
+          `services.hyperhive.matrix.gatewayHost != null` (default
+          `matrix.<hive>`); when either is off no one hosts the GUI
+          and the `M4TR1X →` dashboard tab is hidden.
 
-          fluffychat-web supports per-login server pick — point it at
-          the in-host tuwunel URL (`http://localhost:8008` by
-          default) the first time. The post-#15 nginx-front re-root
-          (`https://matrix.''${services.hyperhive.domain}`) is tracked
-          separately in #609.
+          The `.well-known/matrix/{client,server}` delegation (served
+          on the bare hive-domain) advertises this sub-domain, so
+          clients opened at `http://<hive>/` auto-discover the
+          fluffychat root automatically.
         '';
       };
 
@@ -407,24 +405,25 @@ in
         type = lib.types.package;
         default = fluffychat-web-fixed;
         defaultText = lib.literalMD ''
-          `pkgs.fluffychat-web` rebuilt with `--base-href /matrix/` (#634)
-          and patched via `postInstall` to add the three files
-          `flutter341.buildFlutterApplication` skips: `native_executor.js`
-          (compiled via `dart compile js` from `web/native_executor.dart`),
-          plus `Imaging.js` + `Imaging.wasm` (built from the
-          `native_imaging` dart package's C source via `pkgs.emscripten`).
-          See the `let` block in `nix/modules/hive-matrix.nix` for the
-          full rationale (#685).
+          `pkgs.fluffychat-web` patched via `postInstall` to add the
+          three files `flutter341.buildFlutterApplication` skips:
+          `native_executor.js` (compiled via `dart compile js` from
+          `web/native_executor.dart`), plus `Imaging.js` +
+          `Imaging.wasm` (built from the `native_imaging` dart
+          package's C source via `pkgs.emscripten`). See the `let`
+          block in `nix/modules/hive-matrix.nix` for the full
+          rationale (#685, #772).
         '';
         description = ''
-          Static web client dist to serve at `/matrix/`. Defaults to
-          `pkgs.fluffychat-web` rebuilt with `--base-href "/matrix/"`
-          so relative asset paths resolve under the sub-path mount
-          (#634), plus a `postInstall` patch for #685's three missing
-          files. Override to swap for `hydrogen-web` (lightest),
-          `cinny` (no threads), `element-web` (heaviest, full
-          features), or an out-of-tree client dist — any replacement
-          also needs its `<base href>` aligned with the mount path.
+          Static web client dist to serve at the matrix sub-domain
+          root (`matrix.''${services.hyperhive.domain}/`). Defaults
+          to `pkgs.fluffychat-web` with the #685 `postInstall` patch
+          for the three missing files. Override to swap for
+          `hydrogen-web` (lightest), `cinny` (no threads),
+          `element-web` (heaviest, full features), or an out-of-tree
+          client dist — any replacement gets served at the sub-domain
+          root with the upstream-default `<base href "/">`, no
+          sub-path gymnastics needed.
         '';
       };
     };