dashboard: meta flake inputs UI + sequential rebuild loop

new section 'M3T4 1NPUTS' between approvals and message flow:
one row per input in meta/flake.lock (hyperhive first, then
agent-<n> alphabetically). each row shows the input name, the
first 12 chars of the locked sha, a relative timestamp from
locked.lastModified, and the original.url when available.
checkbox per row; submit button is disabled until at least one
box is checked; submitting confirms then POSTs the selected
names to /meta-update.

backend:
- meta::lock_update(inputs: &[String]) — runs 'nix flake update
  <names>' in the meta dir, commits the lock change with a
  combined message ('lock update: hyperhive, agent-coder').
  preserves the existing META_LOCK serialization. existing
  lock_update_for_rebuild / lock_update_hyperhive stay for
  their single-input callers.
- POST /meta-update — comma-separated 'inputs' form field
  (JS joins checkboxes since axum::Form doesn't natively
  decode repeated keys); spawns a background task that runs
  the lock update + per-agent rebuild loop. hyperhive
  selection fans out to all agents; agent-<n> selection only
  rebuilds <n>. each rebuild fires Rebuilt to the manager
  exactly like dashboard / admin-CLI / auto-update.

rebuild loop is sequential — auto_update::run too (was
parallel via tokio::spawn). parallel rebuilds collide on
nix-store's sqlite cache ('sqlite db busy, not using cache')
and the meta META_LOCK contention. nix-daemon serializes the
heavy build steps anyway, so this isn't a throughput loss.

hive-c0re/assets/dashboard.css

@@ -288,6 +288,56 @@ code {
 .glyph-approved { color: var(--green); }
 .glyph-denied { color: var(--red); }
 .glyph-failed { color: var(--amber); }
+.meta-inputs {
+  list-style: none;
+  padding: 0;
+  margin: 0 0 0.8em;
+  display: grid;
+  gap: 0.2em;
+}
+.meta-inputs li {
+  padding: 0.25em 0.6em;
+  border: 1px solid var(--border);
+  background: rgba(24, 24, 37, 0.6);
+}
+.meta-inputs label {
+  display: flex;
+  align-items: baseline;
+  gap: 0.5em;
+  cursor: pointer;
+  font-size: 0.9em;
+}
+.meta-input-name { color: var(--amber); font-weight: bold; }
+.meta-input-rev { color: var(--muted); }
+.meta-input-ts { color: var(--muted); font-size: 0.85em; }
+.meta-input-url {
+  color: var(--muted);
+  font-size: 0.85em;
+  margin-left: auto;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+.btn-meta-update {
+  background: rgba(203, 166, 247, 0.12);
+  border: 1px solid var(--purple);
+  color: var(--purple);
+  text-shadow: 0 0 4px currentColor;
+  padding: 0.3em 1em;
+  font: inherit;
+  font-size: 0.85em;
+  letter-spacing: 0.08em;
+  cursor: pointer;
+  transition: box-shadow 0.15s ease, background 0.15s ease;
+}
+.btn-meta-update:hover:not([disabled]) {
+  background: rgba(203, 166, 247, 0.22);
+  box-shadow: 0 0 10px -2px currentColor;
+}
+.btn-meta-update[disabled] {
+  opacity: 0.35;
+  cursor: not-allowed;
+}
 .history-note {
   margin-left: 1.8em;
   margin-top: 0.2em;