frontend: wire static-dir env var + per-agent extraFiles option

Phase 3 of #273. Container plumbing for the bundled frontend dist:

- flake.nix overlay: `pkgs.hyperhive-frontend` exposed for the
  agent / manager containers (mirrors the existing `pkgs.hyperhive`
  pattern); module argument `hyperhiveFrontend = system: self
  .packages.${system}.frontend` threads the package into the host
  hive-c0re module without forcing operators to apply the overlay
  on their host pkgs.

- `services.hive-c0re.frontend` option: pinned to the flake's
  frontend package by default, overridable for custom dashboard
  SPAs. The hive-c0re systemd service gets `HIVE_STATIC_DIR =
  ${cfg.frontend}/dashboard` — the Rust binary will pick it up
  in Phase 4.

- `hyperhive.frontend.dist` option: per-container, defaults to
  `pkgs.hyperhive-frontend`. Override to ship a fully custom
  agent SPA (advanced; the default + extraFiles flow handles the
  common 'add files' case).

- `hyperhive.frontend.extraFiles` option: attrsOf submodule
  (mirroring the `hyperhive.extraMcpServers` shape per damocles'
  request so existing #322-style assertions keep their grip).
  Each entry has `source` (path relative to agent.nix) and
  `target` (URL/disk prefix within the merged static tree,
  defaulting to the attribute name). Operator-named example:
  the bitburner agent drops `bitburner-dist` into
  `/bitburner/` alongside the default agent UI at `/`.

- `hyperhive.frontend.mergedDist` (readOnly): the runCommand
  derivation that composes `agent/` from the default dist plus
  every `extraFiles` entry. Aborts on overwrite so a filename
  collision becomes a build error rather than a silent dist swap.
  agent-base.nix + manager.nix set their respective systemd
  service `HIVE_STATIC_DIR` to this merged path.

Until Phase 4 lands, the env var is set but unused — the Rust
binaries still serve assets via `include_str!`. The cutover
happens in the next commit on this branch.

Refs #273.

flake.nix

@@ -69,6 +69,13 @@
       overlays = {
         default = final: prev: {
           hyperhive = self.packages.${prev.stdenv.hostPlatform.system}.default;
+          # Bundled frontend dist (see ./nix/frontend.nix). Output is
+          # $out/{dashboard,agent}/; consumers pick the surface they
+          # need. Exposed via the overlay so containers' nix evaluations
+          # can reach it as `pkgs.hyperhive-frontend` once the overlay
+          # is applied (manager + agent containers both apply it via
+          # `mkContainer` further down).
+          hyperhive-frontend = self.packages.${prev.stdenv.hostPlatform.system}.frontend;
         };
         claude-unstable =
           final: prev:
@@ -102,6 +109,7 @@
         # builds (already applied internally in `nixosConfigurations`).
         hive-c0re = import ./nix/modules/hive-c0re.nix {
           hyperhivePackage = system: self.packages.${system}.default;
+          hyperhiveFrontend = system: self.packages.${system}.frontend;
           hyperhiveFlake = "${self}";
         };
         hive-forge = ./nix/modules/hive-forge.nix;