refactor(3202): all-local asserts the host's own /etc/hosts entries

Clause 2 of #3202, reading 1 (mara: "the all local stuff and swarm
services auto conf belong in those mods, not spread all over").

`gateway.localHostsEntry` is the gateway's only local-deployment knob —
`openFirewall` is about EXTERNAL exposure, `tls.acme` needs a public DNS
name, `hsts` is a hardening choice. It is now asserted by the mode in
local-defaults.nix, beside the three swarm toggles, instead of being the
one all-local implication an operator still had to know about.

`mkDefault`, so "all local except this" still needs no new option.

⚠️ The non-obvious half: this does NOT change what CONTAINERS resolve.
dnsmasq sets `no-hosts = true` unconditionally, so agents keep getting
the bridge IP from the authoritative `address=` rules rather than the
host's 127.0.0.1 — which would point every agent at its own netns. That
guard already existing is what makes this safe to default on; without it
this one line would break every agent's access to the forge.

nix/host-modules/hive-gateway/options.nix

@@ -91,6 +91,12 @@ in
         gateway shape. Off by default — operators running with real
         DNS shouldn't have a stale `/etc/hosts` entry sticking
         around. Requires `services.hyperhive.domain` to be set.
+
+        `services.hyperhive.enableAllLocalDefaults` turns this on as
+        part of saying "this box is the whole deployment": that mode
+        means there is no real DNS for these names and the operator is
+        browsing them from the host itself. Set it here explicitly to
+        override in either direction.
       '';
     };