refactor(gateway): move DockerGateway to the backend layer, drop the dead standalone-gateway path

The `DockerGateway` container-lifecycle impl now lives in
`backend/docker/gateway.py` (the shape backend gateway classes will share);
`orchestrator/gateway.py` keeps only the backend-neutral pieces (the `Gateway`
ABC, constants, `rotate_gateway_ca`).

Delete the standalone-gateway path it was the only consumer of. `--gateway` on
`python -m bot_bottle.orchestrator` was invoked nowhere — the production docker
flow runs the gateway data plane inside the combined `bot-bottle-infra`
container via `OrchestratorService`, never this class. Removing it takes with it
`Orchestrator.ensure_gateway()` and the `gateway` ctor arg; `gateway_status()`
becomes a stub reporting `configured: false` so the documented `GET /gateway`
control-plane route keeps its contract.

Fix a latent bug the move surfaced: `launch.py` read the shared gateway CA via
`docker exec bot-bottle-orch-gateway`, a container the consolidated flow never
creates — so the agent CA install was reaching a nonexistent name. Read it from
`bot-bottle-infra` (INFRA_NAME) instead.

Repoint the affected tests to the new module; drop the unit test + fake that
covered the deleted standalone wiring.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bot_bottle/orchestrator/__init__.py

@@ -10,10 +10,10 @@ backend-neutral "consolidation core" that needs no VM packaging:
   * `broker`        — the signed, structured launch-request contract + a
                       `LaunchBroker` (stub for the harness) that verifies
                       provenance before acting.
-  * `gateway`       — the consolidated per-host gateway: a `Gateway`
-                      lifecycle contract (idempotent singleton) + a
-                      `DockerGateway` impl. One gateway shared by all
-                      bottles instead of one per bottle.
+  * `gateway`       — the consolidated per-host gateway: the `Gateway`
+                      lifecycle contract (idempotent singleton). One
+                      gateway shared by all bottles instead of one per
+                      bottle; backend impls live under `backend/*/gateway`.
   * `service`       — the `Orchestrator`: owns the registry, brokers the
                       launch lifecycle (launch/teardown), manages the
                       shared gateway, attributes.
@@ -38,7 +38,7 @@ from .broker import (
     verify_request,
 )
 from .docker_broker import DockerBroker, DockerBrokerError
-from .gateway import DockerGateway, Gateway, GatewayError
+from .gateway import Gateway, GatewayError
 from .service import Orchestrator
 from .control_plane import ControlPlaneServer, dispatch, make_server
 
@@ -53,7 +53,6 @@ __all__ = [
     "DockerBroker",
     "DockerBrokerError",
     "Gateway",
-    "DockerGateway",
     "GatewayError",
     "sign_request",
     "verify_request",