refactor(backend): move git-gate provisioning to a neutral module

`backend/docker/gateway_provision.py` had no docker-specific code left once
`DockerGatewayTransport` moved out — `provision_git_gate` / `deprovision_git_gate`
drive any `GatewayTransport`, and the guest-side paths they write
(`/git-gate/creds/<id>`, `/git/<id>`, `/etc/git-gate/...`) are identical inside
every backend's gateway. Yet the neutral `backend/consolidated_util.py` reached
into the docker package to import them.

Move it to `backend/gateway_provision.py`, a sibling of its only importer. The
gateway *package* can't host it (git_gate already imports gateway.git_gate,
so gateway importing git_gate would cycle), but the backend layer uses git_gate
freely. Docstrings + the git_gate/service.py pointer updated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bot_bottle/backend/firecracker/gateway_transport.py

@@ -4,7 +4,7 @@
 How the launcher stages files + runs commands in the running gateway: the
 docker exec/cp equivalents over SSH (dropbear + the stable infra key). The
 backend-neutral provisioning logic that drives it lives in
-`backend.docker.gateway_provision`.
+`backend.gateway_provision`.
 """
 
 from __future__ import annotations