swarm-ui: bootstrap new swarm-level frontend (Preact + wouter + TS + JSX)

Project-bootstrap scope per the issue: static build as a nix pkg,
empty start page for now, functionality deferred until auth against
authelia is figured out. Stack (Preact + wouter + TypeScript + JSX)
matches the shell decision from the earlier framework-paths thread —
a real SPA shell with a router and deep links, distinct from the
per-hive dashboard's vanilla-JS + custom-element MPA.

- New npm workspace frontend/packages/swarm-ui: one route (/), a
  wouter Switch/Route shell, a 404 fallback. Reuses @hive/shared's
  colors.css/theme.css/base.css for visual consistency; no other
  shared JS (the vanilla-JS el()/dom.js helpers are superseded by
  Preact in this shell).
- nix/packages/swarm-ui.nix: its own buildNpmPackage derivation
  (scoped to just this workspace via an explicit buildPhase), not
  folded into nix/packages/frontend.nix's packages.default closure —
  same reasoning swarm-controller/swarmctl already use for staying out
  of daemonBins: a hive that doesn't run the swarm controller
  shouldn't carry swarm-ui bytes.
- npmDepsHash recomputed in both frontend.nix and swarm-ui.nix (same
  shared lockfile, new deps: preact, wouter-preact, typescript).
- Added swarm-ui to nix/checks.nix alongside frontend, for the same
  FOD-staleness reason plus being the only thing that actually builds
  it in CI (not in packages.default's closure like frontend is, so
  nix flake check wouldn't otherwise touch it).
- npm run typecheck (tsc --noEmit) is available locally; not yet wired
  into CI — esbuild transpiles TS without type-checking, so that's a
  real gap, left as a follow-up rather than growing this bootstrap PR
  with a new CI workflow step.

Verified: nix build .#swarm-ui and .#frontend both succeed; npm run
build (root, all workspaces) succeeds; tsc --noEmit clean;
scripts/check-issue-refs.sh clean.

nix/checks.nix

@@ -69,7 +69,14 @@ in
   # every PR and only breaks when the host toplevel is built on deploy.
   # Reusing the already-defined `packages.<system>.frontend` derivation
   # makes such a hash mismatch a red PR instead of a red main.
-  inherit (self.packages.${system}) frontend;
+  #
+  # `swarm-ui` alongside it for the same FOD-staleness reason (shares
+  # the same lockfile / `npmDepsHash`, see nix/packages/swarm-ui.nix) —
+  # plus, since it's not in `packages.default`'s dependency closure like
+  # `frontend` is, this is also the only thing that actually *builds*
+  # it in CI rather than just evaluating it (`nix flake check` doesn't
+  # build every `packages.<system>.*` output on its own).
+  inherit (self.packages.${system}) frontend swarm-ui;
 
   # `hivectl` CLI reference freshness check. The committed
   # markdown at `docs/tools/hivectl-cli.md` is the rendered