refactor(frontend): base16 theme contract in a swappable colors.css

Split the palette into two standalone stylesheets:
- colors.css — the 16 base16 slots (--base00..--base0F). This is the
  entire theme swap contract; a generator (e.g. a stylix base16 scheme,
  which is natively base00-base0F) replaces only this file.
- theme.css — the semantic layer (--bg, --purple, …) derived from the
  base16 slots via var()/color-mix. Never changes on a swap.

Every page links colors.css then theme.css; theme.css does NOT @import
colors.css (that would re-bake the slots into it) — they're separate
dist outputs so a swap touches just colors.css. Pixel-identical refactor:
base16 defaults are Catppuccin Mocha and the three off-slot vars
(--crust, --muted, --subtext0) derive via color-mix reproducing their
exact prior hexes.

Wires colors.css through both build.mjs CSS entry lists, the
@hive/shared exports map, and all 7 page templates. css-vars.md + the
frontend.nix output-list comment updated.

frontend/packages/agent/src/theme.css

@@ -1,6 +1,6 @@
-/* Standalone theme bundle — re-exports the shared Catppuccin palette so
-   esbuild emits it as its own `dist/static/theme.css`, linked first by
-   every agent page. Kept separate from the page bundles so a theme swap
-   (e.g. stylix) replaces only this file. See @hive/shared/theme.css +
-   docs/web-ui/css-vars.md. */
+/* Standalone semantic theme layer — re-exports the shared derivation so
+   esbuild emits it as its own `dist/static/theme.css`, linked by every
+   agent page right after colors.css. The base16 slots it derives from
+   live in colors.css (the swap contract); a theme swap replaces only
+   that file. See @hive/shared/theme.css + docs/web-ui/css-vars.md. */
 @import "@hive/shared/theme.css";