refactor(gateway): move DockerGateway to the backend layer, drop the dead standalone-gateway path

The `DockerGateway` container-lifecycle impl now lives in
`backend/docker/gateway.py` (the shape backend gateway classes will share);
`orchestrator/gateway.py` keeps only the backend-neutral pieces (the `Gateway`
ABC, constants, `rotate_gateway_ca`).

Delete the standalone-gateway path it was the only consumer of. `--gateway` on
`python -m bot_bottle.orchestrator` was invoked nowhere — the production docker
flow runs the gateway data plane inside the combined `bot-bottle-infra`
container via `OrchestratorService`, never this class. Removing it takes with it
`Orchestrator.ensure_gateway()` and the `gateway` ctor arg; `gateway_status()`
becomes a stub reporting `configured: false` so the documented `GET /gateway`
control-plane route keeps its contract.

Fix a latent bug the move surfaced: `launch.py` read the shared gateway CA via
`docker exec bot-bottle-orch-gateway`, a container the consolidated flow never
creates — so the agent CA install was reaching a nonexistent name. Read it from
`bot-bottle-infra` (INFRA_NAME) instead.

Repoint the affected tests to the new module; drop the unit test + fake that
covered the deleted standalone wiring.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/unit/test_orchestrator_gateway.py

@@ -7,10 +7,10 @@ import unittest
 from pathlib import Path
 from unittest.mock import Mock, patch
 
+from bot_bottle.backend.docker.gateway import DockerGateway
 from bot_bottle.orchestrator.gateway import (
     GATEWAY_CA_CERT,
     GATEWAY_NAME,
-    DockerGateway,
     GatewayError,
     rotate_gateway_ca,
 )
@@ -20,7 +20,7 @@ from tests.unit import use_bottle_root
 
 _CA_PEM = "-----BEGIN CERTIFICATE-----\nMII...\n-----END CERTIFICATE-----\n"
 
-_RUN_DOCKER = "bot_bottle.orchestrator.gateway.run_docker"
+_RUN_DOCKER = "bot_bottle.backend.docker.gateway.run_docker"
 
 
 def _proc(returncode: int = 0, stdout: str = "", stderr: str = "") -> Mock:
@@ -162,7 +162,7 @@ class TestDockerGateway(unittest.TestCase):
         # First read: CA not there yet; second read: present.
         seq = [_proc(returncode=1, stderr="No such file"), _proc(stdout=_CA_PEM)]
         with patch(_RUN_DOCKER, side_effect=seq), \
-                patch("bot_bottle.orchestrator.gateway.time.sleep"):
+                patch("bot_bottle.backend.docker.gateway.time.sleep"):
             self.assertEqual(_CA_PEM, self.sc.ca_cert_pem(timeout=5))
 
     def test_ensure_running_reuses_existing_network(self) -> None: