refactor(frontend): base16 theme contract in a swappable colors.css

Split the palette into two standalone stylesheets:
- colors.css — the 16 base16 slots (--base00..--base0F). This is the
  entire theme swap contract; a generator (e.g. a stylix base16 scheme,
  which is natively base00-base0F) replaces only this file.
- theme.css — the semantic layer (--bg, --purple, …) derived from the
  base16 slots via var()/color-mix. Never changes on a swap.

Every page links colors.css then theme.css; theme.css does NOT @import
colors.css (that would re-bake the slots into it) — they're separate
dist outputs so a swap touches just colors.css. Pixel-identical refactor:
base16 defaults are Catppuccin Mocha and the three off-slot vars
(--crust, --muted, --subtext0) derive via color-mix reproducing their
exact prior hexes.

Wires colors.css through both build.mjs CSS entry lists, the
@hive/shared exports map, and all 7 page templates. css-vars.md + the
frontend.nix output-list comment updated.

nix/frontend.nix

@@ -18,12 +18,12 @@
 #       index.html (H0M3 hub, served at /) dashboard.html (operator SPA,
 #       served at /dashboard.html) flow.html logs.html favicon.svg
 #       static/{home,tabs,flow,logs,stream-worker}.js{,.map}
-#       static/{common,home,dashboard,flow,logs,theme}.css
+#       static/{colors,theme,common,home,dashboard,flow,logs}.css
 #   $out/agent/       the per-agent default UI (layered with
 #                     hyperhive.frontend.extraFiles at activation time)
 #       index.html stats.html screen.html
 #       static/{app,stats}.js{,.map}
-#       static/agent.css
+#       static/{colors,theme,agent}.css
 #
 # The dashboard favicon lives outside the npm tree (`branding/hyperhive
 # .svg` at the repo root) — we copy it in during the install phase so