[jim-toth]

Summary

Adds Nomad job definitions for hyperbeam-gateway on stage and live. The gateway serves hb-stage.anyone.tech and hb.anyone.tech from the services pool and reaches the node through its internal Consul service. Stacked on #14.

Changes

• operations/hyperbeam-gateway-stage.hcl and operations/hyperbeam-gateway-live.hcl: one allocation in stage-services / live-services, dynamic port on the wireguard host network, Traefik router for the environment's hostname with a per-address rate limit and a 1 MB body cap, /healthz check.
• Node address from the Consul service hyperbeam-<env>-node; process ids from smart-contracts/<env>/*-address.
• Host volume hyperbeam-gateway-<env> at /data for the message record. The task keeps the image's bun user, so the volume is owned by uid 1000.
• No canary: a deploy replaces the running allocation, so one instance writes the record at a time. Reverts if the new allocation is not healthy.
• Admin actions stay off until ADMIN_ACTIONS and ADMIN_SIGNERS are set.
• commit_sha has no default until an image is published from the default branch.
• operations/README.md: what the job sets up, volume setup, deploy and post-deploy checks.

Verified

• nomad fmt -check and nomad job run -output (Nomad 1.9.7) on both files: namespace, pool, router rule, volume, image and environment render as intended.
• Confirmed the base image's bun user is uid 1000 and that the image has no curl or wget, so the in-allocation check uses bun.
• Not deployed.