docs/gateway.md: extract hive-c0re + hive-forge prose blocks (#718 batch 2)

Continues #718 docs-extraction. Three more blocks moved to
`docs/gateway.md` (which already houses the gateway architecture
story from #775):

1. **Firewall posture (gateway on vs off)** — was a 22-line block
   above `networking.firewall = lib.mkIf ...` in hive-c0re.nix.
   Trimmed to 3-line ref. New `docs/gateway.md::Firewall posture
   (host-level)` section covers the gateway-on / gateway-off
   trade-off + why dashboard port stays loopback-only.

2. **`HIVE_FORGE_URL` loopback rationale** — was a 14-line block
   above the env-var assignment. Trimmed to 5-line ref. New
   `docs/gateway.md::HIVE_FORGE_URL: loopback for in-cluster,
   sub-domain for the operator` section covers the in-cluster vs
   external split + why agent containers can't use the sub-domain.

3. **hive-forge container shape** — was a 15-line top-of-`config`
   block in hive-forge.nix explaining the nixos-container + host
   netns choices. Trimmed to 4-line ref. New
   `docs/gateway.md::hive-forge container shape` section captures
   the same content with state-dir + wipe-via-destroy notes.

Net: hive-c0re.nix -29 lines, hive-forge.nix -11 lines, gateway.md
+44 lines. Same pattern as #782 (first pass) per iris's #10114
guidance — substantive WHY moves to docs as named sub-paragraphs,
in-code shrinks to `// see docs/<file>::<section>` refs.

Verified: `nix eval` on agent-base toplevel still resolves
cleanly; firewall posture unchanged (still 0 ports opened in the
gateway-on case + the same 8100..8999 range in the gateway-off
case).

Continues #718. Follow-up batches: remaining harness-base.nix
blocks, nix/docs/default.nix, nix/assets.nix, nix/templates/weston-vnc.nix.

docs/gateway.md

@@ -76,3 +76,54 @@ SSH for forge stays direct on `cfg.sshPort` — separate listener protocol, not
 - #772 / #775 — fluffychat hops from `<hive>/matrix/` to `matrix.<hive>/`.
 
 Next-up tracked separately: #14 (container netns isolation), TLS (#594).
+
+## Firewall posture (host-level)
+
+`hive-c0re.nix` opens the per-agent web-port range
+`8100..8999` in the host firewall **only when
+`services.hyperhive.gateway.enable = false`**. With the gateway on
+(default), it's the sole external entry point and proxies to
+`127.0.0.1:<port>` internally — leaving the per-agent ports
+firewall-open would defeat the single-front-door story (closes
+#621).
+
+Manager hashes into the same range since #753 (no more
+"manager pinned at 8000" special case), so one range opening covers
+every container.
+
+The dashboard port (`cfg.dashboardPort`, default 7000) is *not*
+listed in either case — since #652 it binds `127.0.0.1` only, so a
+firewall hole would be a no-op. Remote dashboard access flows
+through the gateway. Operators who opt out of the gateway lose
+external dashboard reach by design — the surface is privileged
+(approve / deny / destroy) and must not be exposed without a real
+reverse proxy in front.
+
+## `HIVE_FORGE_URL`: loopback for in-cluster, sub-domain for the operator
+
+Agents poll `HIVE_FORGE_URL` for Forgejo notifications + run all
+`hive-forge` calls against it. `hive-c0re.nix` pins this to
+`http://127.0.0.1:<forge.httpPort>` for the in-cluster path: every
+agent container shares the host's network namespace, so loopback
+reaches the forge container directly with no DNS lookup needed
+(closes #761).
+
+The post-#754 sub-domain default (`forge.<hive-domain>`) is for
+**operator browsers + cross-host clients**, not in-cluster traffic.
+Using the sub-domain URL inside agent containers would fail every
+`hive-forge` invocation with "Name or service not known" — the
+agent's nspawn doesn't have DNS for the external hostname.
+
+## hive-forge container shape
+
+Private Forgejo wrapped in a nixos-container (`hive-forge`, not
+`h-*` — keeps c0re's lifecycle scanner out of the picture; the
+operator manages it via the standard `nixos-container` CLI).
+Container shares the host network namespace
+(`privateNetwork = false`) so agents reach the forge at
+`http://localhost:<httpPort>` without extra plumbing — nixos-container
+is here for state + systemd-unit isolation, not network isolation.
+
+State lives at `/var/lib/nixos-containers/hive-forge/var/lib/forgejo/`
+and survives container restart / host reboot. To wipe, destroy the
+container.