feat(snap): run gateway as a user service by default

[olivercalder]

Summary

Replace the existing system gateway service with separate user-gateway and system-gateway services. For new installs, only the user-gateway service is enabled, which simplifies TLS certificate access and brings parity with the other packaging formats. For existing installs, only the system-gateway service is enabled, for backwards compatibility.

Related Issue

Addresses the need to run the gateway as a user service in the snap package, as discussed with @drew on Slack. There's not a dedicated issue created yet, sorry. I can create one if necessary. This just concerns packaging and test code, no internal logic.

Changes

• Add separate user-gateway and system-gateway Snap services, both disabled by default and selected through Snap hooks.
• Remove the old gateway app so snapd stops it during upgrades before starting the renamed compatibility service.
• Run fresh installations through user-gateway with user-owned configuration, database, TLS, and JWT state under $SNAP_USER_COMMON.
• Preserve upgraded installations through system-gateway, retaining existing configuration, database, TLS identity, and other state under $SNAP_COMMON.
• Reuse one gateway wrapper for both services by making its canonical configuration path overridable alongside the existing database and TLS path overrides.
• Add a gateway-mode Snap setting with user and system values.
• Add an install hook that initializes fresh installations with gateway-mode=user.
• Add a configure hook that applies gateway-mode, disables the inactive service, and enables the selected service.
• Support switching service models with snap set openshell gateway-mode=user or gateway-mode=system.
• Update the post-refresh hook to identify legacy installations with no existing gateway-mode, migrate explicitly unsafe configuration, and set gateway-mode=system.
• Remove unsafe legacy configuration files or unsafe config symlinks without modifying symlink targets.
• Keep existing user or system selections unchanged during later refreshes.
• Update install.sh to distinguish user and system modes, validate Docker access in the appropriate context, and restart the selected enduring service after explicit refreshes.
• Remove root-to-user TLS copying from fresh user-gateway installations and register them using their user-owned local mTLS bundle.
• Retain root-owned TLS enrollment in the installer for legacy system-gateway upgrades.
• Restore manual TLS enrollment documentation for users whose legacy gateway was migrated by automatic refresh or direct snap refresh, where no target user is available.

Testing

• Checks appropriate to the affected code and behavior pass
• Unit tests added/updated (if applicable)
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.