docs(3191): the gateway's comments describe a host service, not a container

Prose-only sweep of every remaining claim that nginx or dnsmasq lives
in a container: the port comment (root in a container -> root on the
host), upstreamHost's netns rationale, the ACME state dir, the store
path reachability note, the vhost tree header, dnsmasq's resolv.conf
paragraph (there is no copy and no path unit watching it any more),
the two hive-network bridge comments, and swarm-controller's socket
access-control note, which described a bind-mount that no longer
exists.

No behaviour change; all of it was describing a mechanism that was
deleted.

nix/host-modules/hive-gateway/default.nix

@@ -26,9 +26,7 @@ let
   forgeCfg = config.services.hyperhive.swarm.forge;
   networkCfg = config.services.hyperhive.network;
 
-  # Dashboard SPA dist, static-served by nginx. Read in OUTER scope so
-  # `config` is the host's (inside the container block it'd be the
-  # container's).
+  # Dashboard SPA dist, static-served by nginx.
   dashboardDist = "${config.services.hyperhive.c0re.servedFrontend}/dashboard";
 
   # Full hyperhive-themed Swagger UI dist — nginx serves this whole
@@ -243,10 +241,10 @@ in
         # mode behind.
         chmod 0755 ${builtins.dirOf tlsDir}
         chmod 0755 ${tlsDir}
-        # Copy the host leaf in. `install` writes atomically with the
-        # target mode; run as root (container root == host root,
-        # privateUsers=false) so the 0600 root:root host key is
-        # readable. Key ends up root:nginx 0640 so nginx-pre-start
+        # Copy the leaf in. `install` writes atomically with the
+        # target mode; runs as root so the 0600 root:root key written
+        # by hive-tls-ca is readable. Key ends up root:nginx 0640 so
+        # nginx-pre-start
         # (which runs `nginx -t` as the nginx user, not root) can
         # read it — a 0600 root:root key passes the master load but
         # fails the pre-start config test with `BIO_new_file() …