refactor(gateway): make the gateway unconditional — remove gateway.enable

The gateway container starts alongside every hyperhive deployment, so
gating it behind a separate enable flag was a footgun: an operator who
set it false lost the only thing exposed to the outside while the
agent containers kept running. Re-gate the gateway config on the
top-level services.hyperhive.enable instead.

- hive-gateway.nix: drop the gateway.enable mkOption; gate the config
  block on config.services.hyperhive.enable.
- hive-forge.nix: behindGateway now defaults to services.hyperhive.enable;
  remove the behindGateway-requires-gateway assertion (now vacuous).
- hive-network.nix: remove both gateway.enable assertions (vacuous).
- hive-c0re.nix: drop the firewall.allowedTCPPortRanges 8100-8999
  fallback that opened agent ports when the gateway was off (the
  gateway is now the sole entry point); HIVE_GATEWAY_ENABLED is always
  set since the gateway always runs.
- nix/docs/default.nix: remove the gateway.enable = mkForce false stub
  (would be an eval error against the removed option; the gateway is
  already re-gated on hyperhive.enable, which docs force false).
- hive-matrix.nix, dashboard.rs: comment/prose updates only.

BREAKING: operators relying on services.hyperhive.gateway.enable = false
to suppress the gateway must instead point their own reverse proxy at
the gateway's port. NixOS errors clearly on the now-unknown option.

nix/modules/hive-network.nix

@@ -154,16 +154,6 @@ in
             `services.hyperhive.network.enable = false` explicitly.
           '';
         }
-        {
-          assertion = config.services.hyperhive.gateway.enable;
-          message = ''
-            services.hyperhive.network.enable = true requires
-            services.hyperhive.gateway.enable = true — the dnsmasq
-            resolver runs inside the hive-gateway container (single
-            front-door for both DNS and HTTP). Enable the gateway or
-            set `services.hyperhive.network.enable = false` explicitly.
-          '';
-        }
       ];
 
       # Virtual bridge — veth pairs attach when isolateContainers flips on.
@@ -196,17 +186,6 @@ in
             resolver must be running before isolation is flipped on).
           '';
         }
-        {
-          assertion = !config.services.hyperhive.forge.enable || config.services.hyperhive.gateway.enable;
-          message = ''
-            services.hyperhive.network.isolateContainers = true with
-            services.hyperhive.forge.enable = true requires
-            services.hyperhive.gateway.enable = true — isolated agents
-            reach the forge via `http://forge.<domain>` which nginx (in
-            the gateway container) proxies to forgejo. Without the gateway
-            there is nothing listening on port 80 to serve that hostname.
-          '';
-        }
       ];
     })