swarm-ui: bootstrap new swarm-level frontend (Preact + wouter + TS + JSX)

Project-bootstrap scope per the issue: static build as a nix pkg,
empty start page for now, functionality deferred until auth against
authelia is figured out. Stack (Preact + wouter + TypeScript + JSX)
matches the shell decision from the earlier framework-paths thread —
a real SPA shell with a router and deep links, distinct from the
per-hive dashboard's vanilla-JS + custom-element MPA.

- New npm workspace frontend/packages/swarm-ui: one route (/), a
  wouter Switch/Route shell, a 404 fallback. Reuses @hive/shared's
  colors.css/theme.css/base.css for visual consistency; no other
  shared JS (the vanilla-JS el()/dom.js helpers are superseded by
  Preact in this shell).
- nix/packages/swarm-ui.nix: its own buildNpmPackage derivation
  (scoped to just this workspace via an explicit buildPhase), not
  folded into nix/packages/frontend.nix's packages.default closure —
  same reasoning swarm-controller/swarmctl already use for staying out
  of daemonBins: a hive that doesn't run the swarm controller
  shouldn't carry swarm-ui bytes.
- npmDepsHash recomputed in both frontend.nix and swarm-ui.nix (same
  shared lockfile, new deps: preact, wouter-preact, typescript).
- Added swarm-ui to nix/checks.nix alongside frontend, for the same
  FOD-staleness reason plus being the only thing that actually builds
  it in CI (not in packages.default's closure like frontend is, so
  nix flake check wouldn't otherwise touch it).
- npm run typecheck (tsc --noEmit) is available locally; not yet wired
  into CI — esbuild transpiles TS without type-checking, so that's a
  real gap, left as a follow-up rather than growing this bootstrap PR
  with a new CI workflow step.

Verified: nix build .#swarm-ui and .#frontend both succeed; npm run
build (root, all workspaces) succeeds; tsc --noEmit clean;
scripts/check-issue-refs.sh clean.

nix/checks.nix

@@ -69,7 +69,14 @@ in
   # every PR and only breaks when the host toplevel is built on deploy.
   # Reusing the already-defined `packages.<system>.frontend` derivation
   # makes such a hash mismatch a red PR instead of a red main.
-  inherit (self.packages.${system}) frontend;
+  #
+  # `swarm-ui` alongside it for the same FOD-staleness reason (shares
+  # the same lockfile / `npmDepsHash`, see nix/packages/swarm-ui.nix) —
+  # plus, since it's not in `packages.default`'s dependency closure like
+  # `frontend` is, this is also the only thing that actually *builds*
+  # it in CI rather than just evaluating it (`nix flake check` doesn't
+  # build every `packages.<system>.*` output on its own).
+  inherit (self.packages.${system}) frontend swarm-ui;
 
   # `hivectl` CLI reference freshness check. The committed
   # markdown at `docs/tools/hivectl-cli.md` is the rendered

nix/packages/default.nix

@@ -150,6 +150,13 @@ in
   # in the daemon's package so a hive can pin one without the other.
   swarmctl = mkBinPackage "swarmctl" "hyperhive swarm-level operator CLI";
 
+  # Static build of the swarm-level UI shell — see ./swarm-ui.nix. Same
+  # "swarm-scoped, not core-bundle" reasoning as swarm-controller/swarmctl
+  # above, kept a separate package for the same reason: not every hive
+  # runs the swarm controller, so this shouldn't ride along in
+  # `packages.default`'s closure.
+  swarm-ui = pkgs.callPackage ./swarm-ui.nix { };
+
   # Bundled browser assets — see ./frontend.nix. Output is
   # $out/{dashboard,agent}/ which the Rust binaries serve via
   # tower_http::ServeDir.

nix/packages/frontend.nix

@@ -40,7 +40,7 @@ buildNpmPackage {
   # Update whenever the lockfile changes. Recompute locally with the
   # same command (`pkgs.prefetch-npm-deps`), or let the build fail
   # and copy the actual hash from the error message.
-  npmDepsHash = "sha256-jRHMoaE4z9T/K+OfpXorYwGGo4Fp2Dk/+wTMR56kmdA=";
+  npmDepsHash = "sha256-LIwW5Nn9cSqJHCm1czPIVxQdP5OqWk7U/4kvkwaj2ts=";
 
   # `npm run build` recurses into all workspaces (`--workspaces
   # --if-present`). The workspaces' build scripts each run their own

nix/packages/swarm-ui.nix

@@ -0,0 +1,58 @@
+{ buildNpmPackage }:
+
+# Static build of the swarm-level UI shell (project-bootstrap scope:
+# empty start page, no functionality yet — see
+# frontend/packages/swarm-ui/package.json for the full rationale).
+# Stack: Preact + wouter + TypeScript + JSX, a real SPA shell with
+# routing/deep-links, distinct from the per-hive dashboard's
+# vanilla-JS + custom-element MPA.
+#
+# Deliberately its OWN package, not folded into `./frontend.nix`
+# (which bundles dashboard + agent into `packages.default`'s closure):
+# swarm-ui is swarm-scoped, same reasoning `swarm-controller`/`swarmctl`
+# already use for staying out of `daemonBins` — a hive that doesn't run
+# the swarm controller shouldn't carry swarm-ui bytes in its closure.
+#
+# Not yet consumed anywhere: swarm-controller only serves `/health`
+# today (swarm-controller/README.md) — this just makes the static
+# build a buildable, packageable artifact so the wiring (once auth
+# against authelia is figured out) has something to point at.
+#
+# Shares `frontend/package-lock.json` with `./frontend.nix` (same repo,
+# same npm workspace root) — `npmDepsHash` must be updated in lockstep
+# with that file's whenever the lockfile changes, since both hash the
+# same file. Scoped to build only the `swarm-ui` workspace (not the
+# whole `npm run build --workspaces` frontend.nix runs) via an explicit
+# `npm run build --workspace=…` buildPhase, so a dashboard/agent-only
+# change doesn't need to rebuild (or re-review the output of) this
+# derivation.
+
+buildNpmPackage {
+  pname = "hyperhive-swarm-ui";
+  version = "0.0.0";
+  src = ../../frontend;
+
+  # Recompute with `prefetch-npm-deps frontend/package-lock.json`
+  # whenever the lockfile changes — same value as `./frontend.nix`'s
+  # `npmDepsHash`, both hash the one shared lockfile.
+  npmDepsHash = "sha256-LIwW5Nn9cSqJHCm1czPIVxQdP5OqWk7U/4kvkwaj2ts=";
+
+  buildPhase = ''
+    runHook preBuild
+    npm run build --workspace=packages/swarm-ui
+    runHook postBuild
+  '';
+
+  dontNpmInstall = true;
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out
+    cp -r packages/swarm-ui/dist/. $out/
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "hyperhive swarm-level UI static frontend build (bootstrap — empty start page)";
+    homepage = "https://forge.darkest.space/hyperhive/hyperhive";
+  };
+}