hive-gateway: serve the swagger-ui theme via nginx alias, not a c0re build hook

nix/host-modules/hive-gateway/vhosts.nix

@@ -11,6 +11,7 @@
   matrixCfg,
   hyperhiveDomain,
   dashboardDist,
+  swaggerUiTheme, # nix/packages/swagger-ui-theme.nix: has index.html + hyperhive-theme.css
   errorPages, # ./error-pages.nix: { notFound, unreachable, unauthorized }
   tlsCert,
   tlsKey,
@@ -304,6 +305,33 @@ let
       proxyPass = "http://${cfg.upstreamHost}:${toString cfg.upstreamPort}";
     };
   };
+
+  # Swagger UI re-theme: exact-match locations `alias`ed straight to
+  # `swaggerUiTheme`'s store path, nginx-served with no involvement
+  # from hive-c0re at all. `=` locations win over the `/api/` prefix
+  # block above regardless of declaration order (nginx's own location-
+  # matching precedence — exact match beats longest-prefix), so this
+  # doesn't need to be declared before it. Every OTHER Swagger UI asset
+  # (bundle.js, openapi.json, favicons, the *vendored* index.html c0re
+  # would otherwise serve) still falls through `/api/` to c0re's own
+  # embedded `utoipa-swagger-ui` dist unchanged — only these two exact
+  # paths are intercepted. A theme tweak is therefore a change to
+  # `hive-c0re/swagger-ui-theme/` + a gateway container activation, not
+  # a hive-c0re rebuild+restart. See nix/packages/swagger-ui-theme.nix.
+  swaggerThemeLocations = {
+    "= /api/docs/" = {
+      extraConfig = ''
+        alias ${swaggerUiTheme}/index.html;
+        ${dashboardAuth}
+      '';
+    };
+    "= /api/docs/hyperhive-theme.css" = {
+      extraConfig = ''
+        alias ${swaggerUiTheme}/hyperhive-theme.css;
+        ${dashboardAuth}
+      '';
+    };
+  };
 in
 {
   # Accept-header SPA map for the matrix GUI only (see docs/gateway.md
@@ -325,6 +353,7 @@ in
         // wellKnownLocations
         // agentLocations
         // dashboardProxyLocation
+        // swaggerThemeLocations
         // lib.optionalAttrs cfg.auth.enable {
           # Internal-only target for the 401 error_page above.
           # `internal` prevents direct client access; `alias` serves