nix: stop restating the npm-deps-hash regenerate command in 3 places

frontend.nix stays the one authoritative explanation; swarm-ui.nix and
checks.nix now just point at it instead of each restating the
prefetch-npm-deps command in their own words.

frontend/npm-deps-hash

@@ -0,0 +1 @@
+sha256-8mYI9b1nuQ8YNFkW/ezJwO5Qw6NJTDG+kspYozs/5cI=

nix/checks.nix

@@ -149,10 +149,8 @@ in
     version = "0.0.0";
     src = ../frontend;
 
-    # Same lockfile as `frontend`/`swarm-ui` above — recompute in
+    # See `nix/packages/frontend.nix`'s comment on the same line.
-    # lockstep with those two whenever `frontend/package-lock.json`
+    npmDepsHash = builtins.readFile ../frontend/npm-deps-hash;
-    # changes (`prefetch-npm-deps frontend/package-lock.json`).
-    npmDepsHash = "sha256-8mYI9b1nuQ8YNFkW/ezJwO5Qw6NJTDG+kspYozs/5cI=";
 
     buildPhase = ''
       runHook preBuild

nix/packages/frontend.nix

@@ -35,12 +35,15 @@ buildNpmPackage {
   version = "0.0.0";
   src = ../../frontend;
 
-  # Computed from `frontend/package-lock.json` via
+  # Read from `../../frontend/npm-deps-hash`, the single source of
-  #   prefetch-npm-deps frontend/package-lock.json
+  # truth `./swarm-ui.nix` and `../checks.nix`'s `swarm-ui-typecheck`
-  # Update whenever the lockfile changes. Recompute locally with the
+  # also read — all three build from the one `frontend/package-lock.json`,
-  # same command (`pkgs.prefetch-npm-deps`), or let the build fail
+  # so one file keeps them from drifting independently (this used to be
-  # and copy the actual hash from the error message.
+  # a hardcoded copy per derivation, and only some of the three got
-  npmDepsHash = "sha256-8mYI9b1nuQ8YNFkW/ezJwO5Qw6NJTDG+kspYozs/5cI=";
+  # updated the one time the lockfile changed). Regenerate with
+  # `prefetch-npm-deps frontend/package-lock.json` and overwrite the
+  # file whenever the lockfile changes.
+  npmDepsHash = builtins.readFile ../../frontend/npm-deps-hash;
 
   # `npm run build` recurses into all workspaces (`--workspaces
   # --if-present`). The workspaces' build scripts each run their own

nix/packages/swarm-ui.nix

@@ -19,10 +19,12 @@
 # against authelia is figured out) has something to point at.
 #
 # Shares `frontend/package-lock.json` with `./frontend.nix` (same repo,
-# same npm workspace root) — `npmDepsHash` must be updated in lockstep
+# same npm workspace root) — `npmDepsHash` is read from
-# with that file's whenever the lockfile changes, since both hash the
+# `../../frontend/npm-deps-hash`, the same file `./frontend.nix` and
-# same file. Scoped to build only the `swarm-ui` workspace (not the
+# `../checks.nix`'s `swarm-ui-typecheck` read, so all three stay in
-# whole `npm run build --workspaces` frontend.nix runs) via an explicit
+# lockstep automatically instead of needing 3 separate hand-edits.
+# Scoped to build only the `swarm-ui` workspace (not the whole
+# `npm run build --workspaces` frontend.nix runs) via an explicit
 # `npm run build --workspace=…` buildPhase, so a dashboard/agent-only
 # change doesn't need to rebuild (or re-review the output of) this
 # derivation.
@@ -32,10 +34,8 @@ buildNpmPackage {
   version = "0.0.0";
   src = ../../frontend;
 
-  # Recompute with `prefetch-npm-deps frontend/package-lock.json`
+  # See `./frontend.nix`'s comment on the same line.
-  # whenever the lockfile changes — same value as `./frontend.nix`'s
+  npmDepsHash = builtins.readFile ../../frontend/npm-deps-hash;
-  # `npmDepsHash`, both hash the one shared lockfile.
-  npmDepsHash = "sha256-8mYI9b1nuQ8YNFkW/ezJwO5Qw6NJTDG+kspYozs/5cI=";
 
   buildPhase = ''
     runHook preBuild