dashboard: build same-origin /agent/<name>/ links when gateway is up (closes #842)

When `services.hyperhive.gateway.enable` is on (default), the c0re
NixOS module now sets `HIVE_GATEWAY_ENABLED=1` on the service env.
`/api/state` exposes the flag as `gateway_enabled`; the SW4RM tab's
container-row renderer flips three link sites (primary agent-name
link, favicon fetch, `container`-kind nav-strip links) from the
legacy `http://<host>:<port>/` direct TCP shape to same-origin
`/agent/<name>/` URLs — the gateway proxies them to the per-agent
harness via `agent-ports.json` or `agent-sockets.json` (#784 / #815).
Gateway-off deploys keep the direct TCP fallback so local-dev /
operator opt-out keeps working.

`forge`-kind nav-strip links still resolve against `:3000` (separate
sub-domain transition, tracked by `forge.behindGateway`);
`external`-kind links are already absolute.

Mirrors the `HIVE_MATRIX_GUI_ENABLED` env→snapshot-flag pattern.
Docs updated: `docs/web-ui.md::Container row` + new
`docs/gateway.md::Dashboard link shape` section.

nix/modules/hive-c0re.nix

@@ -304,6 +304,15 @@ in
         # dashboard chrome whether the GUI is reachable so iris's
         # `M4TR1X →` tab doesn't show when the GUI is off.
         HIVE_MATRIX_GUI_ENABLED = "1";
+      }
+      // lib.optionalAttrs config.services.hyperhive.gateway.enable {
+        # Availability flag for `/api/state.gateway_enabled`. When
+        # true the dashboard builds same-origin `/agent/<name>/` links
+        # to the per-agent web UI (gateway proxies them); when false
+        # it falls back to direct `http://<hostname>:<port>/` TCP
+        # links (legacy / gateway-disabled ops). See
+        # `docs/gateway.md::Vhost map` for the routing shape.
+        HIVE_GATEWAY_ENABLED = "1";
       };
       # Matrix GUI static serving lives entirely on the hive-gateway
       # nginx since #609 — when gateway is off the operator opts out