refactor(frontend): base16 theme contract in a swappable colors.css

Split the palette into two standalone stylesheets:
- colors.css — the 16 base16 slots (--base00..--base0F). This is the
  entire theme swap contract; a generator (e.g. a stylix base16 scheme,
  which is natively base00-base0F) replaces only this file.
- theme.css — the semantic layer (--bg, --purple, …) derived from the
  base16 slots via var()/color-mix. Never changes on a swap.

Every page links colors.css then theme.css; theme.css does NOT @import
colors.css (that would re-bake the slots into it) — they're separate
dist outputs so a swap touches just colors.css. Pixel-identical refactor:
base16 defaults are Catppuccin Mocha and the three off-slot vars
(--crust, --muted, --subtext0) derive via color-mix reproducing their
exact prior hexes.

Wires colors.css through both build.mjs CSS entry lists, the
@hive/shared exports map, and all 7 page templates. css-vars.md + the
frontend.nix output-list comment updated.

frontend/packages/agent/build.mjs

@@ -43,11 +43,12 @@ await build({
   logLevel: 'info',
 });
 
-// Bundle the CSS. `theme.css` re-exports the standalone Catppuccin
-// palette (kept its own output file so a theme swap replaces only it,
-// no bundle rebuild); `agent.css`'s @import lines pull in shared
-// base.css + terminal.css from the @hive/shared workspace dep.
-for (const entry of ['theme.css', 'agent.css']) {
+// Bundle the CSS. `colors.css` re-exports the standalone base16 palette
+// (the theme swap contract — its own output file so a swap replaces only
+// it, no bundle rebuild); `theme.css` is the semantic derivation layer;
+// `agent.css`'s @import lines pull in shared base.css + terminal.css from
+// the @hive/shared workspace dep.
+for (const entry of ['colors.css', 'theme.css', 'agent.css']) {
   await build({
     entryPoints: [src(entry)],
     outfile: staticDir(entry),