dashboard: meta flake inputs UI + sequential rebuild loop

new section 'M3T4 1NPUTS' between approvals and message flow:
one row per input in meta/flake.lock (hyperhive first, then
agent-<n> alphabetically). each row shows the input name, the
first 12 chars of the locked sha, a relative timestamp from
locked.lastModified, and the original.url when available.
checkbox per row; submit button is disabled until at least one
box is checked; submitting confirms then POSTs the selected
names to /meta-update.

backend:
- meta::lock_update(inputs: &[String]) — runs 'nix flake update
  <names>' in the meta dir, commits the lock change with a
  combined message ('lock update: hyperhive, agent-coder').
  preserves the existing META_LOCK serialization. existing
  lock_update_for_rebuild / lock_update_hyperhive stay for
  their single-input callers.
- POST /meta-update — comma-separated 'inputs' form field
  (JS joins checkboxes since axum::Form doesn't natively
  decode repeated keys); spawns a background task that runs
  the lock update + per-agent rebuild loop. hyperhive
  selection fans out to all agents; agent-<n> selection only
  rebuilds <n>. each rebuild fires Rebuilt to the manager
  exactly like dashboard / admin-CLI / auto-update.

rebuild loop is sequential — auto_update::run too (was
parallel via tokio::spawn). parallel rebuilds collide on
nix-store's sqlite cache ('sqlite db busy, not using cache')
and the meta META_LOCK contention. nix-daemon serializes the
heavy build steps anyway, so this isn't a throughput loss.

hive-c0re/src/meta.rs

@@ -184,6 +184,38 @@ pub async fn lock_update_for_rebuild(name: &str) -> Result<()> {
     git_commit(&dir, &format!("rebuild {name}: lock update")).await
 }
 
+/// Update one or more named inputs in the meta flake and commit
+/// the resulting lock change with a single combined message.
+/// Used by the dashboard's "update meta inputs" form so the
+/// operator can bulk-bump `hyperhive` + selected agents in one
+/// shot. Each input name is passed verbatim to
+/// `nix flake update`; the caller is responsible for picking
+/// real input keys (e.g. via `inputs_view()` snapshotted from
+/// the lock file).
+#[allow(dead_code)] // wired up by dashboard handler in the same commit
+pub async fn lock_update(inputs: &[String]) -> Result<()> {
+    if inputs.is_empty() {
+        return Ok(());
+    }
+    let _guard = META_LOCK.lock().await;
+    let dir = meta_dir();
+    let mut args: Vec<&str> = vec!["flake", "update"];
+    for i in inputs {
+        args.push(i.as_str());
+    }
+    nix(&dir, &args).await?;
+    if git_is_clean(&dir).await? {
+        return Ok(());
+    }
+    git(&dir, &["add", "flake.lock"]).await?;
+    let msg = if inputs.len() == 1 {
+        format!("lock update: {}", inputs[0])
+    } else {
+        format!("lock update: {}", inputs.join(", "))
+    };
+    git_commit(&dir, &msg).await
+}
+
 /// One-shot used by the auto-update path: pin the latest hyperhive
 /// rev, commit if the lock changed. Cheaper than `sync_agents`
 /// because the per-agent inputs aren't touched.