dashboard: meta flake inputs UI + sequential rebuild loop

new section 'M3T4 1NPUTS' between approvals and message flow:
one row per input in meta/flake.lock (hyperhive first, then
agent-<n> alphabetically). each row shows the input name, the
first 12 chars of the locked sha, a relative timestamp from
locked.lastModified, and the original.url when available.
checkbox per row; submit button is disabled until at least one
box is checked; submitting confirms then POSTs the selected
names to /meta-update.

backend:
- meta::lock_update(inputs: &[String]) — runs 'nix flake update
  <names>' in the meta dir, commits the lock change with a
  combined message ('lock update: hyperhive, agent-coder').
  preserves the existing META_LOCK serialization. existing
  lock_update_for_rebuild / lock_update_hyperhive stay for
  their single-input callers.
- POST /meta-update — comma-separated 'inputs' form field
  (JS joins checkboxes since axum::Form doesn't natively
  decode repeated keys); spawns a background task that runs
  the lock update + per-agent rebuild loop. hyperhive
  selection fans out to all agents; agent-<n> selection only
  rebuilds <n>. each rebuild fires Rebuilt to the manager
  exactly like dashboard / admin-CLI / auto-update.

rebuild loop is sequential — auto_update::run too (was
parallel via tokio::spawn). parallel rebuilds collide on
nix-store's sqlite cache ('sqlite db busy, not using cache')
and the meta META_LOCK contention. nix-daemon serializes the
heavy build steps anyway, so this isn't a throughput loss.

hive-c0re/assets/app.js

@@ -760,6 +760,77 @@
     return Math.floor(ageSec / 86400) + 'd ago';
   }
 
+  function renderMetaInputs(s) {
+    const root = $('meta-inputs-section');
+    if (!root) return;
+    root.innerHTML = '';
+    const inputs = s.meta_inputs || [];
+    if (!inputs.length) {
+      root.append(el('p', { class: 'empty' }, 'meta repo not seeded yet'));
+      return;
+    }
+    const form = el('form', {
+      method: 'POST',
+      action: '/meta-update',
+      class: 'meta-inputs-form',
+      'data-async': '',
+      'data-confirm': 'update selected meta flake inputs + rebuild affected agents?',
+    });
+    const ul = el('ul', { class: 'meta-inputs' });
+    for (const inp of inputs) {
+      const li = el('li');
+      const id = 'meta-input-' + inp.name.replace(/[^a-z0-9-]/gi, '_');
+      const cb = el('input', {
+        type: 'checkbox',
+        name: 'meta_input_' + inp.name,
+        id,
+        value: inp.name,
+        'data-meta-input': inp.name,
+      });
+      const label = el('label', { for: id });
+      label.append(
+        cb,
+        el('span', { class: 'meta-input-name' }, inp.name), ' ',
+        el('code', { class: 'meta-input-rev' }, inp.rev.slice(0, 12)), ' ',
+        el('span', { class: 'meta-input-ts' }, fmtAgo(inp.last_modified)),
+      );
+      if (inp.url) {
+        label.append(' ', el('span', { class: 'meta-input-url', title: inp.url },
+          '· ' + truncate(inp.url, 48)));
+      }
+      li.append(label);
+      ul.append(li);
+    }
+    form.append(ul);
+    // Hidden input the POST handler reads — populated at submit
+    // time from the checkbox states. axum's Form extractor doesn't
+    // natively decode repeated keys, so we join into one CSV.
+    const hidden = el('input', { type: 'hidden', name: 'inputs', value: '' });
+    form.append(hidden);
+    const btn = el('button', {
+      type: 'submit',
+      class: 'btn btn-meta-update',
+      disabled: '',
+    }, '◆ UPD4TE & R3BU1LD');
+    form.append(btn);
+    function refreshDisabled() {
+      const any = form.querySelectorAll('input[data-meta-input]:checked').length > 0;
+      if (any) btn.removeAttribute('disabled');
+      else btn.setAttribute('disabled', '');
+    }
+    form.addEventListener('change', refreshDisabled);
+    form.addEventListener('submit', () => {
+      const selected = Array.from(form.querySelectorAll('input[data-meta-input]:checked'))
+        .map((b) => b.dataset.metaInput);
+      hidden.value = selected.join(',');
+    });
+    root.append(form);
+  }
+
+  function truncate(s, n) {
+    return s.length <= n ? s : s.slice(0, n - 1) + '…';
+  }
+
   // ─── state polling ──────────────────────────────────────────────────────
   let pollTimer = null;
   // Sections whose innerHTML gets blown away on each refresh. If the
@@ -771,6 +842,7 @@
     'questions-section',
     'inbox-section',
     'approvals-section',
+    'meta-inputs-section',
   ];
   // <details> sections that should survive a refresh need a stable
   // `data-restore-key` attribute. snapshotOpenDetails walks managed
@@ -833,6 +905,7 @@
       renderQuestions(s);
       renderInbox(s);
       renderApprovals(s);
+      renderMetaInputs(s);
       restoreOpenDetails(openDetails);
       notifyDeltas(s);
       // Auto-refresh: fast (2s) while a spawn or a per-container