refactor(gateway): move DockerGateway to the backend layer, drop the dead standalone-gateway path

The `DockerGateway` container-lifecycle impl now lives in
`backend/docker/gateway.py` (the shape backend gateway classes will share);
`orchestrator/gateway.py` keeps only the backend-neutral pieces (the `Gateway`
ABC, constants, `rotate_gateway_ca`).

Delete the standalone-gateway path it was the only consumer of. `--gateway` on
`python -m bot_bottle.orchestrator` was invoked nowhere — the production docker
flow runs the gateway data plane inside the combined `bot-bottle-infra`
container via `OrchestratorService`, never this class. Removing it takes with it
`Orchestrator.ensure_gateway()` and the `gateway` ctor arg; `gateway_status()`
becomes a stub reporting `configured: false` so the documented `GET /gateway`
control-plane route keeps its contract.

Fix a latent bug the move surfaced: `launch.py` read the shared gateway CA via
`docker exec bot-bottle-orch-gateway`, a container the consolidated flow never
creates — so the agent CA install was reaching a nonexistent name. Read it from
`bot-bottle-infra` (INFRA_NAME) instead.

Repoint the affected tests to the new module; drop the unit test + fake that
covered the deleted standalone wiring.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bot_bottle/orchestrator/__main__.py

@@ -22,7 +22,6 @@ from .control_plane import make_server
 from .docker_broker import DockerBroker
 from .registry import RegistryStore, default_db_path
 from .service import Orchestrator
-from .gateway import DockerGateway, Gateway
 
 
 def main(argv: list[str] | None = None) -> int:
@@ -38,10 +37,6 @@ def main(argv: list[str] | None = None) -> int:
         "--broker", choices=("stub", "docker"), default="stub",
         help="launch broker: 'stub' records requests; 'docker' runs containers",
     )
-    parser.add_argument(
-        "--gateway", action="store_true",
-        help="run one consolidated per-host gateway (build-if-missing)",
-    )
     args = parser.parse_args(argv)
 
     registry = RegistryStore(args.db)
@@ -57,20 +52,7 @@ def main(argv: list[str] | None = None) -> int:
     # anything; 'docker' runs real containers (firecracker drops in later).
     secret = secrets.token_bytes(32)
     broker: LaunchBroker = DockerBroker(secret) if args.broker == "docker" else StubBroker(secret)
-    # Standalone `--gateway` (not the consolidated flow, where the host
-    # lifecycle runs the gateway). The gateway resolves against this same
-    # process; the URL is only reachable when they share a docker network.
-    gateway: Gateway | None = (
-        DockerGateway(orchestrator_url=f"http://{args.host}:{args.port}")
-        if args.gateway else None
-    )
-    orchestrator = Orchestrator(registry, broker, secret, gateway)
-
-    # One persistent per-host gateway, shared by every bottle: build the
-    # bundle image if missing, then bring the singleton up (idempotent).
-    if gateway is not None:
-        orchestrator.ensure_gateway()
-        log.info("consolidated gateway ensured", context={"name": gateway.name})
+    orchestrator = Orchestrator(registry, broker, secret)
 
     server = make_server(orchestrator, host=args.host, port=args.port)
     bound_host, bound_port = server.server_address[0], server.server_address[1]