refactor(gateway): make the gateway unconditional — remove gateway.enable

The gateway container starts alongside every hyperhive deployment, so
gating it behind a separate enable flag was a footgun: an operator who
set it false lost the only thing exposed to the outside while the
agent containers kept running. Re-gate the gateway config on the
top-level services.hyperhive.enable instead.

- hive-gateway.nix: drop the gateway.enable mkOption; gate the config
  block on config.services.hyperhive.enable.
- hive-forge.nix: behindGateway now defaults to services.hyperhive.enable;
  remove the behindGateway-requires-gateway assertion (now vacuous).
- hive-network.nix: remove both gateway.enable assertions (vacuous).
- hive-c0re.nix: drop the firewall.allowedTCPPortRanges 8100-8999
  fallback that opened agent ports when the gateway was off (the
  gateway is now the sole entry point); HIVE_GATEWAY_ENABLED is always
  set since the gateway always runs.
- nix/docs/default.nix: remove the gateway.enable = mkForce false stub
  (would be an eval error against the removed option; the gateway is
  already re-gated on hyperhive.enable, which docs force false).
- hive-matrix.nix, dashboard.rs: comment/prose updates only.

BREAKING: operators relying on services.hyperhive.gateway.enable = false
to suppress the gateway must instead point their own reverse proxy at
the gateway's port. NixOS errors clearly on the now-unknown option.

hive-c0re/src/dashboard.rs

@@ -229,15 +229,15 @@ struct StateSnapshot {
     /// chrome so the `M4TR1X →` tab doesn't flash when the GUI is off.
     matrix_gui_enabled: bool,
     /// Whether `hive-gateway` is in front of this dashboard. Sourced
-    /// from `HIVE_GATEWAY_ENABLED` env var (set by the c0re NixOS
-    /// module when `services.hyperhive.gateway.enable` is on). When
-    /// true the dashboard frontend builds same-origin
-    /// `/agent/<name>/` links to the per-agent web UI (the gateway
-    /// routes them via the runtime-generated `agents.conf` include
-    /// file — see `gateway_nginx.rs`); when false it falls back to
-    /// direct `http://<hostname>:<port>/` TCP links so gateway-off /
-    /// local-dev deploys keep working. See `docs/gateway.md::Vhost
-    /// map`.
+    /// from the `HIVE_GATEWAY_ENABLED` env var, which the c0re NixOS
+    /// module now always sets (the gateway runs unconditionally
+    /// alongside hyperhive), so this is effectively always true: the
+    /// dashboard frontend builds same-origin `/agent/<name>/` links to
+    /// the per-agent web UI (the gateway routes them via the
+    /// runtime-generated `agents.conf` include file — see
+    /// `gateway_nginx.rs`). The `false` branch (direct
+    /// `http://<hostname>:<port>/` TCP links) is retained as a defensive
+    /// fallback for the env being unset. See `docs/gateway.md::Vhost map`.
     gateway_enabled: bool,
     /// Public URL of the forge vhost served by hive-gateway (e.g.
     /// `"https://forge.pr1ma.darkest.space"`). Sourced from the
@@ -480,7 +480,7 @@ async fn api_state(headers: HeaderMap, State(state): State<AppState>) -> axum::J
         gateway_enabled: std::env::var_os("HIVE_GATEWAY_ENABLED").is_some_and(|v| {
             // Same truthy-string parse as `matrix_gui_enabled`; the
             // env var is set by the c0re NixOS module to the literal
-            // "1" when `services.hyperhive.gateway.enable` is on.
+            // "1" — the gateway always runs alongside hyperhive.
             let s = v.to_string_lossy().to_ascii_lowercase();
             matches!(s.as_str(), "1" | "true" | "yes")
         }),