refactor(gateway): make the gateway unconditional — remove gateway.enable

The gateway container starts alongside every hyperhive deployment, so
gating it behind a separate enable flag was a footgun: an operator who
set it false lost the only thing exposed to the outside while the
agent containers kept running. Re-gate the gateway config on the
top-level services.hyperhive.enable instead.

- hive-gateway.nix: drop the gateway.enable mkOption; gate the config
  block on config.services.hyperhive.enable.
- hive-forge.nix: behindGateway now defaults to services.hyperhive.enable;
  remove the behindGateway-requires-gateway assertion (now vacuous).
- hive-network.nix: remove both gateway.enable assertions (vacuous).
- hive-c0re.nix: drop the firewall.allowedTCPPortRanges 8100-8999
  fallback that opened agent ports when the gateway was off (the
  gateway is now the sole entry point); HIVE_GATEWAY_ENABLED is always
  set since the gateway always runs.
- nix/docs/default.nix: remove the gateway.enable = mkForce false stub
  (would be an eval error against the removed option; the gateway is
  already re-gated on hyperhive.enable, which docs force false).
- hive-matrix.nix, dashboard.rs: comment/prose updates only.

BREAKING: operators relying on services.hyperhive.gateway.enable = false
to suppress the gateway must instead point their own reverse proxy at
the gateway's port. NixOS errors clearly on the now-unknown option.

nix/modules/hive-forge.nix

@@ -112,8 +112,8 @@ in
 
     behindGateway = lib.mkOption {
       type = lib.types.bool;
-      default = gatewayCfg.enable or false;
-      defaultText = lib.literalExpression "config.services.hyperhive.gateway.enable";
+      default = config.services.hyperhive.enable;
+      defaultText = lib.literalExpression "config.services.hyperhive.enable";
       description = ''
         Serve forgejo through the hive-gateway nginx as a sub-domain
         vhost (`server_name = cfg.domain`) instead of directly on
@@ -127,9 +127,9 @@ in
         - `gateway.localHostsEntry = true` extends `/etc/hosts` to
           include `cfg.domain → 127.0.0.1` for local dev.
 
-        Defaults to `services.hyperhive.gateway.enable` — flipping
-        the gateway on/off auto-routes forge through it. Set `false`
-        explicitly to keep forge on the direct port even when the
+        Defaults to `services.hyperhive.enable` (the gateway always runs
+        alongside hyperhive, so forge auto-routes through it). Set `false`
+        explicitly to keep forge on the direct port even though the
         gateway is running (e.g. an external git client that doesn't
         traverse the gateway).
 
@@ -211,21 +211,6 @@ in
           or "git.internal".
         '';
       }
-      {
-        # behindGateway requires the gateway module to actually be on.
-        # Otherwise the configured `ROOT_URL` flips to a sub-domain
-        # shape that has no nginx vhost backing it → broken on the
-        # rebuild.
-        assertion = !cfg.behindGateway || (gatewayCfg.enable or false);
-        message = ''
-          services.hyperhive.forge.behindGateway = true requires
-          services.hyperhive.gateway.enable = true (the gateway vhost
-          serving forge needs the gateway container to actually be
-          running). Either turn the gateway on, or set
-          services.hyperhive.forge.behindGateway = false to keep forge
-          on its direct port.
-        '';
-      }
     ];
 
     containers.hive-forge = {