swarm-ui: bootstrap new swarm-level frontend (Preact + wouter + TS + JSX)

Project-bootstrap scope per the issue: static build as a nix pkg,
empty start page for now, functionality deferred until auth against
authelia is figured out. Stack (Preact + wouter + TypeScript + JSX)
matches the shell decision from the earlier framework-paths thread —
a real SPA shell with a router and deep links, distinct from the
per-hive dashboard's vanilla-JS + custom-element MPA.

- New npm workspace frontend/packages/swarm-ui: one route (/), a
  wouter Switch/Route shell, a 404 fallback. Reuses @hive/shared's
  colors.css/theme.css/base.css for visual consistency; no other
  shared JS (the vanilla-JS el()/dom.js helpers are superseded by
  Preact in this shell).
- nix/packages/swarm-ui.nix: its own buildNpmPackage derivation
  (scoped to just this workspace via an explicit buildPhase), not
  folded into nix/packages/frontend.nix's packages.default closure —
  same reasoning swarm-controller/swarmctl already use for staying out
  of daemonBins: a hive that doesn't run the swarm controller
  shouldn't carry swarm-ui bytes.
- npmDepsHash recomputed in both frontend.nix and swarm-ui.nix (same
  shared lockfile, new deps: preact, wouter-preact, typescript).
- Added swarm-ui to nix/checks.nix alongside frontend, for the same
  FOD-staleness reason plus being the only thing that actually builds
  it in CI (not in packages.default's closure like frontend is, so
  nix flake check wouldn't otherwise touch it).
- npm run typecheck (tsc --noEmit) is available locally; not yet wired
  into CI — esbuild transpiles TS without type-checking, so that's a
  real gap, left as a follow-up rather than growing this bootstrap PR
  with a new CI workflow step.

Verified: nix build .#swarm-ui and .#frontend both succeed; npm run
build (root, all workspaces) succeeds; tsc --noEmit clean;
scripts/check-issue-refs.sh clean.

frontend/packages/swarm-ui/src/App.tsx

@@ -0,0 +1,35 @@
+// Root shell component. Empty start page for now — functionality
+// (swarm roster, target-state view, whatever the swarm-controller
+// epic eventually needs) is out of scope until auth against authelia
+// is figured out. What's here IS in scope: a real router + deep-link
+// shape that the per-hive dashboard's vanilla-JS + custom-element MPA
+// doesn't have, so later work has a shell to land routes into instead
+// of bolting routing on after the fact.
+import { Route, Switch } from 'wouter-preact';
+
+function Home() {
+  return (
+    <main class="swarm-ui-empty">
+      <h1>swarm ui</h1>
+      <p>nothing here yet — project-bootstrap placeholder.</p>
+    </main>
+  );
+}
+
+function NotFound() {
+  return (
+    <main class="swarm-ui-empty">
+      <h1>404</h1>
+      <p>no route here.</p>
+    </main>
+  );
+}
+
+export function App() {
+  return (
+    <Switch>
+      <Route path="/" component={Home} />
+      <Route component={NotFound} />
+    </Switch>
+  );
+}