feat(c0re): auto-theme the dashboard from stylix when present

When the operator's host config has stylix enabled, generate a base16
colors.css from its palette and overlay it onto the bundled frontend dist,
then serve that themed tree as the dashboard's HIVE_STATIC_DIR. Zero-op
auto-detect — no flake input, no operator action, no npm/esbuild rebuild
(a pure file-copy over the prebuilt dist). colors.css is the whole swap
contract; theme.css derives the semantic vars from the 16 base16 slots.

Guarded access (config.lib.stylix / config.stylix.enable via 'or' fallbacks)
makes it a clean no-op when stylix isn't imported — HIVE_STATIC_DIR stays
on the unthemed dist, which is what every non-stylix deployment + CI gets.

Dashboard surface only for now; the agent surface needs the base16 palette
forwarded host->agent (the per-agent harness builds its own dist) and is a
separate follow-up.

nix/modules/hive-c0re.nix

@@ -50,6 +50,57 @@ let
       model_prices = cfg.modelPrices;
     }
   );
+
+  # Stylix theme integration (zero-op auto-detect). When the operator's
+  # host config has stylix enabled, generate a base16 `colors.css` from
+  # its palette and overlay it onto the bundled frontend dist so the
+  # dashboard re-themes with no operator action and no npm/esbuild rebuild
+  # (a pure file-copy over the prebuilt dist). `colors.css` is the entire
+  # swap contract — `theme.css` derives every semantic var from the 16
+  # base16 slots (see docs/web-ui/css-vars.md). The guarded access makes
+  # this a clean no-op when stylix isn't imported into the host config.
+  stylixThemeColors =
+    if (config.stylix.enable or false) && ((config.lib.stylix or { }) ? colors) then
+      config.lib.stylix.colors.withHashtag
+    else
+      null;
+  themedColorsCss =
+    c:
+    pkgs.writeText "hyperhive-colors.css" ''
+      :root {
+        --base00: ${c.base00};
+        --base01: ${c.base01};
+        --base02: ${c.base02};
+        --base03: ${c.base03};
+        --base04: ${c.base04};
+        --base05: ${c.base05};
+        --base06: ${c.base06};
+        --base07: ${c.base07};
+        --base08: ${c.base08};
+        --base09: ${c.base09};
+        --base0A: ${c.base0A};
+        --base0B: ${c.base0B};
+        --base0C: ${c.base0C};
+        --base0D: ${c.base0D};
+        --base0E: ${c.base0E};
+        --base0F: ${c.base0F};
+      }
+    '';
+  # Overlay the generated colors.css onto the dashboard dist subtree.
+  # Dashboard-first: only the dashboard surface is wired to this
+  # (HIVE_STATIC_DIR below), so we swap only the dashboard's colors.css.
+  # Agent theming is a separate follow-up — the per-agent harness builds
+  # its frontend in its own nixosSystem, so it needs the base16 palette
+  # forwarded host→agent rather than this host-side overlay.
+  themedFrontend =
+    c:
+    pkgs.runCommand "hyperhive-frontend-themed" { } ''
+      cp -r ${cfg.frontend} $out
+      chmod -R u+w $out
+      install -m644 ${themedColorsCss c} $out/dashboard/static/colors.css
+    '';
+  servedDashboardFrontend =
+    if stylixThemeColors != null then themedFrontend stylixThemeColors else cfg.frontend;
 in
 {
   # The forge is part of the standard install — hive-c0re mirrors
@@ -672,7 +723,7 @@ in
         # Path to the dashboard static dist. The hive-c0re axum router
         # serves this via `tower_http::ServeDir` for any path it doesn't
         # match against an API/action route.
-        HIVE_STATIC_DIR = "${cfg.frontend}/dashboard";
+        HIVE_STATIC_DIR = "${servedDashboardFrontend}/dashboard";
         # Path to the base agent frontend dist. hive-c0re's
         # gateway_nginx.rs uses this to generate split location
         # blocks in agents.conf — static HTML/CSS/JS served from the