swarm-ui: wire npm run typecheck into nix flake checks

Argus flagged on this PR's review that esbuild only strips TS types
without checking them, so a real type error would build clean and
pass every other check. Mara asked for it to be wired in on the same
PR.

Adds checks.swarm-ui-typecheck: a separate buildNpmPackage derivation
(not folded into swarm-ui.nix itself, which doesn't need typescript in
node_modules for its actual esbuild-only build) running
'npm run typecheck --workspace=packages/swarm-ui', same shared
npmDepsHash as frontend/swarm-ui.

Verified: nix build .#checks.x86_64-linux.swarm-ui-typecheck succeeds;
nix fmt clean; scripts/check-issue-refs.sh clean.

nix/checks.nix

@@ -78,6 +78,45 @@ in
   # build every `packages.<system>.*` output on its own).
   inherit (self.packages.${system}) frontend swarm-ui;
 
+  # TypeScript type-check for `swarm-ui` (`npm run typecheck`, i.e.
+  # `tsc --noEmit`). esbuild only strips types without checking them
+  # (see `frontend/packages/swarm-ui/build.mjs`'s own comment), so
+  # without this a real type error would still build clean and pass
+  # every other check. Argus flagged the gap on this PR's review;
+  # wiring it in now per mara's follow-up ask on the same PR, rather
+  # than leaving it as a someday-issue.
+  #
+  # A separate `buildNpmPackage` derivation rather than folding into
+  # `swarm-ui` itself: this one's whole job is to *fail loudly* on a
+  # type error, and `npm ci` + `tsc` needs `typescript` in
+  # `node_modules`, which `swarm-ui.nix`'s actual build doesn't need
+  # (esbuild transpiles TS without it) — no reason to make the real
+  # build depend on the dev-only type-checker.
+  swarm-ui-typecheck = pkgs.buildNpmPackage {
+    pname = "hyperhive-swarm-ui-typecheck";
+    version = "0.0.0";
+    src = ../frontend;
+
+    # Same lockfile as `frontend`/`swarm-ui` above — recompute in
+    # lockstep with those two whenever `frontend/package-lock.json`
+    # changes (`prefetch-npm-deps frontend/package-lock.json`).
+    npmDepsHash = "sha256-LIwW5Nn9cSqJHCm1czPIVxQdP5OqWk7U/4kvkwaj2ts=";
+
+    buildPhase = ''
+      runHook preBuild
+      npm run typecheck --workspace=packages/swarm-ui
+      runHook postBuild
+    '';
+
+    dontNpmInstall = true;
+    installPhase = ''
+      runHook preInstall
+      mkdir -p $out
+      touch $out/ok
+      runHook postInstall
+    '';
+  };
+
   # `hivectl` CLI reference freshness check. The committed
   # markdown at `docs/tools/hivectl-cli.md` is the rendered
   # output of the hidden `hivectl markdown-docs` subcommand