swarm-ui: swap colors.css via a plain nginx location, not a package-copy derivation

mara, on review: "i thought we just swap a css file via nginx
config?" -- right instinct. The package-copy overlay (cp -r + install)
only made sense for hive-c0re's servedFrontend, which backs multiple
serve points (dashboard root + every per-agent gateway route) from one
swapped tree. swarm-ui has exactly one location serving cfg.package, so
an = /static/colors.css exact-match override -- the same idiom every
other single-path override on this vhost already uses (/api/whoami,
/api/docs) -- replaces the whole derivation with one location block.

Verified with the same throwaway nixosSystem eval as the previous
commit: unthemed case has no colors.css location and the / root is
cfg.package unchanged.

nix/host-modules/hive-c0re/theme.nix

@@ -7,6 +7,10 @@
 # from the 16 base16 slots (see docs/web-ui/css-vars.md). The guarded
 # access makes this a clean no-op when stylix isn't imported into the
 # host config. Exposed as the read-only `c0re.servedFrontend` option.
+#
+# Detection + CSS-generation itself lives in `../stylix-theme.nix`
+# (shared with `swarm-ui.nix`) — this file is the c0re-specific overlay
+# consumer (which subtrees, which option).
 {
   pkgs,
   lib,
@@ -15,33 +19,8 @@
 }:
 let
   cfg = config.services.hyperhive.c0re;
-  stylixThemeColors =
-    if (config.stylix.enable or false) && ((config.lib.stylix or { }) ? colors) then
-      config.lib.stylix.colors.withHashtag
-    else
-      null;
-  themedColorsCss =
-    c:
-    pkgs.writeText "hyperhive-colors.css" ''
-      :root {
-        --base00: ${c.base00};
-        --base01: ${c.base01};
-        --base02: ${c.base02};
-        --base03: ${c.base03};
-        --base04: ${c.base04};
-        --base05: ${c.base05};
-        --base06: ${c.base06};
-        --base07: ${c.base07};
-        --base08: ${c.base08};
-        --base09: ${c.base09};
-        --base0A: ${c.base0A};
-        --base0B: ${c.base0B};
-        --base0C: ${c.base0C};
-        --base0D: ${c.base0D};
-        --base0E: ${c.base0E};
-        --base0F: ${c.base0F};
-      }
-    '';
+  stylixTheme = import ../stylix-theme.nix { inherit lib config pkgs; };
+  inherit (stylixTheme) stylixThemeColors themedColorsCss;
   # Overlay the generated colors.css onto both dist subtrees. Both the
   # dashboard (served by hive-c0re via HIVE_STATIC_DIR) and the agent UIs
   # (served by the gateway from HIVE_AGENT_FRONTEND_DIR — static files

nix/host-modules/stylix-theme.nix

@@ -0,0 +1,59 @@
+# Shared stylix theming helper: detects an active stylix palette on the
+# host and renders it as a base16 `colors.css` overlay file. `colors.css`
+# is the entire theme-swap contract for every frontend bundle in this
+# project (`theme.css` derives every semantic var from these 16 slots —
+# see docs/web-ui/css-vars.md), so "apply the operator's stylix palette"
+# always reduces to "write this one file over the prebuilt dist's own
+# `colors.css`" — no npm/esbuild rebuild needed.
+#
+# Two consumers today: `hive-c0re/theme.nix` (dashboard + agent
+# frontend), `swarm-ui.nix` (the swarm-level UI). Factored out here
+# rather than duplicated in both — same "one source, not a copy that
+# agrees by inspection" reasoning `hive-gateway/vhost-lib.nix` gives for
+# its own split. Both callers `import` this directly (not published via
+# an option): unlike the gateway's vhost kit, this needs no per-service
+# knowledge to construct, it's a pure read of the host's own top-level
+# `config` — an option indirection would add a layer with nothing to
+# publish through it.
+#
+# Guarded access makes `stylixThemeColors` a clean `null` when stylix
+# isn't imported into the host config at all, so every caller's own
+# `if stylixThemeColors != null then ... else <untouched package>`
+# stays a zero-op when the operator hasn't opted in.
+{
+  lib,
+  config,
+  pkgs,
+}:
+let
+  stylixThemeColors =
+    if (config.stylix.enable or false) && ((config.lib.stylix or { }) ? colors) then
+      config.lib.stylix.colors.withHashtag
+    else
+      null;
+  themedColorsCss =
+    c:
+    pkgs.writeText "hyperhive-colors.css" ''
+      :root {
+        --base00: ${c.base00};
+        --base01: ${c.base01};
+        --base02: ${c.base02};
+        --base03: ${c.base03};
+        --base04: ${c.base04};
+        --base05: ${c.base05};
+        --base06: ${c.base06};
+        --base07: ${c.base07};
+        --base08: ${c.base08};
+        --base09: ${c.base09};
+        --base0A: ${c.base0A};
+        --base0B: ${c.base0B};
+        --base0C: ${c.base0C};
+        --base0D: ${c.base0D};
+        --base0E: ${c.base0E};
+        --base0F: ${c.base0F};
+      }
+    '';
+in
+{
+  inherit stylixThemeColors themedColorsCss;
+}

nix/host-modules/swarm-ui.nix

@@ -9,6 +9,7 @@
 {
   lib,
   config,
+  pkgs,
   ...
 }:
 let
@@ -17,6 +18,26 @@ let
   autheliaCfg = config.services.hyperhive.swarm.authelia;
   controllerCfg = config.services.hyperhive.swarm.controller;
 
+  # Same stylix auto-theming `hive-c0re/theme.nix` gives the dashboard —
+  # this UI was left out of that overlay entirely (an operator with a
+  # stylix-themed host saw the dashboard in their own colours but this
+  # UI still on the default Catppuccin palette), because nothing here
+  # ever served a themed `colors.css` in place of `cfg.package`'s own.
+  # Detection + CSS-generation is shared (`./stylix-theme.nix`).
+  #
+  # No package-copy derivation: this vhost has exactly one location
+  # serving `cfg.package` (unlike hive-c0re's `servedFrontend`, which
+  # backs both the dashboard root AND every per-agent gateway route, so
+  # a single swapped tree covers both) — an `= /static/colors.css`
+  # exact-match location overriding just that one file, same idiom
+  # every other single-path override on this vhost already uses
+  # (`/api/whoami`, `/api/docs`), is simpler than copying the whole
+  # static tree to change one file inside it. mara, on review: "i
+  # thought we just swap a css file via nginx config?" — yes, and this
+  # is that.
+  stylixTheme = import ./stylix-theme.nix { inherit lib config pkgs; };
+  inherit (stylixTheme) stylixThemeColors themedColorsCss;
+
   # Repeated verbatim by every location that should be operator-gated
   # (`/`, `/api/`, `/api/docs/`) rather than set once on the server:
   # nginx's `auth_request` does NOT inherit across sibling locations, so
@@ -178,6 +199,23 @@ in
               try_files $uri /index.html;
             '';
           };
+        }
+        // lib.optionalAttrs (stylixThemeColors != null) {
+          # Stylix theming (see the `let` block above): overrides just
+          # this one file from `cfg.package`'s own static root, rather
+          # than copying the whole tree to change one file inside it —
+          # nginx resolves the more specific `=` exact match over the
+          # `/` prefix root above, so this simply doesn't exist (falling
+          # through to the package's own untouched colors.css) when
+          # there's no active palette. Same `auth_request` gate as every
+          # other location here — no reason for this one path to have a
+          # different failure mode than the page that loads it.
+          "= /static/colors.css" = {
+            alias = "${themedColorsCss stylixThemeColors}";
+            extraConfig = swarmAuthRequest;
+          };
+        }
+        // {
           # swarm-controller's whole HTTP surface, including the live
           # `/api/openapi.json` spec — proxied untouched (no URI segment
           # after the socket path, same "pass the request through as-is"