route gateway htpasswd management through a daemon wire command (#2504)

hive-host-sock/src/lib.rs

@@ -200,6 +200,21 @@ pub enum HostRequest {
         #[serde(default)]
         password: Option<String>,
     },
+    /// Add or update a gateway HTTP-Basic user in the daemon's htpasswd file
+    /// (`paths::GATEWAY_HTPASSWD`). Daemon-side equivalent of `hivectl gateway
+    /// create-user`: the daemon bcrypt-hashes `password` (cost 12, remapped to
+    /// the `$2y$` prefix nginx accepts) and writes the entry, so hivectl never
+    /// touches the file. `password` is read client-side (inline flag or stdin).
+    /// Returns a confirmation line in [`HostResponse::messages`].
+    GatewayCreateUser { username: String, password: String },
+    /// Remove a gateway HTTP-Basic user from the daemon's htpasswd file.
+    /// Daemon-side equivalent of `hivectl gateway delete-user`. Errors if the
+    /// user isn't present so a no-op is detectable.
+    GatewayDeleteUser { username: String },
+    /// List the gateway HTTP-Basic usernames in the daemon's htpasswd file.
+    /// Daemon-side equivalent of `hivectl gateway list-users`; the usernames
+    /// come back in [`HostResponse::messages`], one per line.
+    GatewayListUsers,
     /// Write (or overwrite) an agent's GitHub PAT under its state dir, via
     /// the privileged helper. Daemon-side equivalent of `hivectl github
     /// set-token`. `token` is resolved + non-empty-validated client-side