fix: show 2FA errors in modal, fix stale device check, add dark mode

- Keep TwoFactorModal open after code submit; display server-side
  errors inline instead of silently closing the modal
- handlePair now returns PairedDeviceInfo so handleInstall uses the
  fresh UDID instead of stale closure state
- Add explicit /wisp/ location in nginx.conf returning 502 to prevent
  SPA fallback from swallowing websocket upgrades
- Add prefers-color-scheme dark mode via CSS custom property overrides;
  replace hardcoded rgba/hex with color-mix() for automatic adaptation

dependencies/webmuxd/package.json

@@ -28,7 +28,7 @@
     "build": "bun run build:openssl-wasm && tsc && bun run copy:openssl-wasm",
     "build:openssl-wasm": "cd ../../wasm/openssl && bun run build",
     "copy:openssl-wasm": "bun scripts/copy-openssl-wasm.mjs",
-    "prepare": "bun run build",
+    "prepack": "bun run build",
     "prepublishOnly": "bun run test && bun run lint",
     "preversion": "bun run lint",
     "version": "bun run format && git add -A src",