gateway: nginx-hosts the full Swagger UI dist, core drops the fallback

Extends the theme-only alias into the full shape mara asked for on the
PR thread:

1. nix/packages/swagger-ui-dist.nix — plain vendored Swagger UI 5.17.14
   dist, sourced directly from the swagger-ui-dist npm package (same
   release the Rust utoipa-swagger-ui-vendored crate ships, verified
   via matching gitHead commit) rather than through Cargo.lock/cargo.
2. nix/packages/swagger-ui-theme.nix — overlays our 3 override files
   (index.html, hyperhive-theme.css, and now swagger-initializer.js)
   onto (1).
3. vhosts.nix's swaggerUiLocations now prefix-matches the whole
   /api/docs/ tree (not just 2 exact-match files) straight from (2),
   plus a `= /api/docs` redirect shim since hive-c0re's own redirect
   is going away too. /api/openapi.json (outside this prefix) keeps
   proxying to c0re unchanged — that's the one thing that stays
   dynamic.

New file swagger-initializer.js needed hand-verification: the plain
vendored copy hardcodes the swagger.io petstore demo URL.
utoipa-swagger-ui normally rewrites it per-request from a {{config}}
placeholder its own build.rs injects — since hive-c0re won't be
serving this file at all once its SwaggerUi mount is removed, that
rewrite has to be baked in statically here instead. Derived by
actually running build.rs's own two transforms (strip the default
layout: line, splice the Config JSON in place of the url/deepLinking
block) against the real vendored file, not typed from scratch —
verified byte-for-byte against what format_config() would produce for
hive-c0re's actual single-URL config, and checked with node --check.

Coordinated with damocles: he's taking the corresponding hive-c0re
side (drop the utoipa-swagger-ui dependency + SwaggerUi::new(...)
mount, keep only the plain /api/openapi.json route) once this lands.

Verified: nix fmt clean; nix build .#swagger-ui-theme succeeds, output
byte-matches the checked-in override files and node --check passes on
swagger-initializer.js; a full nixosSystem eval of nixosModules.default
resolves both new locations (/api/docs/ aliased to the right store
path, = /api/docs redirecting) with auth threaded through.

nix/packages/default.nix

@@ -18,6 +18,13 @@ let
     inherit (nixpkgs.lib) nixosSystem;
   };
 
+  # Plain vendored Swagger UI dist (./swagger-ui-dist.nix) + the
+  # hyperhive-themed overlay on top (./swagger-ui-theme.nix) — bound
+  # here (not just inline in the attrset below) so the theme
+  # derivation can take the dist derivation as an explicit input.
+  swagger-ui-dist = pkgs.callPackage ./swagger-ui-dist.nix { };
+  swagger-ui-theme = pkgs.callPackage ./swagger-ui-theme.nix { inherit swagger-ui-dist; };
+
   # Every per-binary package: name → description. The single source of
   # truth for the bin list — it drives the per-bin extractor packages
   # and the `default` bundle, so adding a binary is one entry here.
@@ -158,11 +165,13 @@ in
   xdg-icons = pkgs.callPackage ./hive-xdg-icons.nix {
     hyperhiveSvg = ../../branding/hyperhive.svg;
   };
-  # Swagger UI re-theme static override files — see
-  # ./swagger-ui-theme.nix. The gateway `alias`es these straight from
-  # the store; a theme tweak is a gateway config change, not a
-  # hive-c0re rebuild.
-  swagger-ui-theme = pkgs.callPackage ./swagger-ui-theme.nix { };
+  # Swagger UI: plain vendored dist + the hyperhive-themed overlay —
+  # see ./swagger-ui-dist.nix / ./swagger-ui-theme.nix (both computed
+  # above, in `let`). The gateway serves `swagger-ui-theme`'s full
+  # tree straight from the store at /api/docs/; a theme tweak is a
+  # gateway config change, not a hive-c0re rebuild. `swagger-ui-dist`
+  # is exposed too since it's independently useful/inspectable.
+  inherit swagger-ui-dist swagger-ui-theme;
 
   # Pre-built per-container system closures. Exposed as packages
   # so operators can `nix build .#agent-base-toplevel` (or wire