docs(3191): the gateway's comments describe a host service, not a container

Prose-only sweep of every remaining claim that nginx or dnsmasq lives
in a container: the port comment (root in a container -> root on the
host), upstreamHost's netns rationale, the ACME state dir, the store
path reachability note, the vhost tree header, dnsmasq's resolv.conf
paragraph (there is no copy and no path unit watching it any more),
the two hive-network bridge comments, and swarm-controller's socket
access-control note, which described a bind-mount that no longer
exists.

No behaviour change; all of it was describing a mechanism that was
deleted.

nix/host-modules/hive-c0re/environment.nix

@@ -33,9 +33,8 @@ in
   # gateway_nginx.rs uses this to generate split location
   # blocks in agents.conf — static HTML/CSS/JS served from the
   # nix store directly; dynamic API paths still proxied to the
-  # agent daemon. The nix store is shared across nspawn
-  # containers, so this path is reachable from inside the
-  # gateway container's nginx.
+  # agent daemon. nginx runs on the host, which is where this
+  # store path already is, so it is reachable as written.
   HIVE_AGENT_FRONTEND_DIR = "${cfg.servedFrontend}/agent";
   # Path to the static runtime asset tree (branding + claude
   # prompts). `hive_sh4re::assets::*` reads paths underneath.