refactor(gateway): make the gateway unconditional — remove gateway.enable

The gateway container starts alongside every hyperhive deployment, so
gating it behind a separate enable flag was a footgun: an operator who
set it false lost the only thing exposed to the outside while the
agent containers kept running. Re-gate the gateway config on the
top-level services.hyperhive.enable instead.

- hive-gateway.nix: drop the gateway.enable mkOption; gate the config
  block on config.services.hyperhive.enable.
- hive-forge.nix: behindGateway now defaults to services.hyperhive.enable;
  remove the behindGateway-requires-gateway assertion (now vacuous).
- hive-network.nix: remove both gateway.enable assertions (vacuous).
- hive-c0re.nix: drop the firewall.allowedTCPPortRanges 8100-8999
  fallback that opened agent ports when the gateway was off (the
  gateway is now the sole entry point); HIVE_GATEWAY_ENABLED is always
  set since the gateway always runs.
- nix/docs/default.nix: remove the gateway.enable = mkForce false stub
  (would be an eval error against the removed option; the gateway is
  already re-gated on hyperhive.enable, which docs force false).
- hive-matrix.nix, dashboard.rs: comment/prose updates only.

BREAKING: operators relying on services.hyperhive.gateway.enable = false
to suppress the gateway must instead point their own reverse proxy at
the gateway's port. NixOS errors clearly on the now-unknown option.

nix/modules/hive-c0re.nix

@@ -634,15 +634,9 @@ in
     };
     users.groups.hive-core = { };
 
-    # Open the per-agent web-port range when the gateway is *off* —
-    # otherwise the gateway nginx is the sole external entry point.
-    # See `docs/gateway.md::Firewall posture (host-level)`.
-    networking.firewall.allowedTCPPortRanges = lib.mkIf (!config.services.hyperhive.gateway.enable) [
-      {
-        from = 8100;
-        to = 8999;
-      }
-    ];
+    # The gateway nginx is always the sole external entry point (it runs
+    # alongside hyperhive), so the per-agent web-port range stays closed on
+    # the host firewall. See `docs/gateway.md::Firewall posture (host-level)`.
 
     # WireGuard inter-hive mesh. Enabled when
     # `services.hyperhive.swarm.wireguard.enable = true`. Brings up a
@@ -777,9 +771,11 @@ in
         # docs/gateway.md::Vhost map.
         HIVE_MATRIX_GUI_ENABLED = "1";
       }
-      // lib.optionalAttrs config.services.hyperhive.gateway.enable {
-        # When true the dashboard builds same-origin `/agent/<name>/`
-        # links; when false it falls back to direct `<host>:<port>` TCP.
+      // {
+        # The gateway always runs, so the dashboard always builds
+        # same-origin `/agent/<name>/` links (never the direct
+        # `<host>:<port>` TCP fallback). Kept as an env flag so the
+        # dashboard doesn't need to learn the gateway is unconditional.
         HIVE_GATEWAY_ENABLED = "1";
       }
       //