refactor(gateway): make the gateway unconditional — remove gateway.enable

The gateway container starts alongside every hyperhive deployment, so
gating it behind a separate enable flag was a footgun: an operator who
set it false lost the only thing exposed to the outside while the
agent containers kept running. Re-gate the gateway config on the
top-level services.hyperhive.enable instead.

- hive-gateway.nix: drop the gateway.enable mkOption; gate the config
  block on config.services.hyperhive.enable.
- hive-forge.nix: behindGateway now defaults to services.hyperhive.enable;
  remove the behindGateway-requires-gateway assertion (now vacuous).
- hive-network.nix: remove both gateway.enable assertions (vacuous).
- hive-c0re.nix: drop the firewall.allowedTCPPortRanges 8100-8999
  fallback that opened agent ports when the gateway was off (the
  gateway is now the sole entry point); HIVE_GATEWAY_ENABLED is always
  set since the gateway always runs.
- nix/docs/default.nix: remove the gateway.enable = mkForce false stub
  (would be an eval error against the removed option; the gateway is
  already re-gated on hyperhive.enable, which docs force false).
- hive-matrix.nix, dashboard.rs: comment/prose updates only.

BREAKING: operators relying on services.hyperhive.gateway.enable = false
to suppress the gateway must instead point their own reverse proxy at
the gateway's port. NixOS errors clearly on the now-unknown option.

nix/modules/hive-matrix.nix

@@ -248,8 +248,8 @@ in
         defaultText = lib.literalExpression "config.services.hyperhive.matrix.enable";
         description = ''
           Serve a matrix web client at `matrix.''${services.hyperhive.domain}/`.
-          Requires `gateway.enable` + `matrix.gatewayHost != null`
-          (default true / `matrix.<hive>` when hive-domain set). When
+          Requires `matrix.gatewayHost != null` (default `matrix.<hive>`
+          when hive-domain set); the gateway itself always runs. When
           off, the dashboard's `M4TR1X →` tab is hidden. See
           `docs/gateway.md` for the discovery flow that lets clients
           auto-find the sub-domain.
@@ -435,9 +435,9 @@ in
     # boot failure this module fixes was an *empty* resolv.conf, a parse
     # error, not a connectivity one) — so this is robustness, not a boot
     # requirement. Soft `after` ordering (not `requires`) keeps the matrix
-    # container's lifecycle decoupled from the gateway's. `network.enable`
-    # asserts `gateway.enable`, so the gateway container unit always exists
-    # here. (Declarative `containers.<n>` → `container@<n>.service` — the
+    # container's lifecycle decoupled from the gateway's. The gateway
+    # always runs alongside hyperhive, so the gateway container unit always
+    # exists here. (Declarative `containers.<n>` → `container@<n>.service` — the
     # nspawn template NixOS generates, confirmed from the live
     # `container@hive-matrix.service` host unit.)
     systemd.services."container@hive-matrix".after = lib.mkIf networkCfg.enable [