Configurable public or private visibility with dashboard gating

Hive now exposes a HIVE_VISIBILITY setting that controls who can reach the dashboard. The default public lets anyone use the instance without signing in; setting it to private gates dashboard routes behind login so only authenticated users (matching a configured provider’s domain allowlist) can access them. The login page stays reachable either way, so admins can always sign in on a public instance.