fix: show 2FA errors in modal, fix stale device check, add dark mode

- Keep TwoFactorModal open after code submit; display server-side
  errors inline instead of silently closing the modal
- handlePair now returns PairedDeviceInfo so handleInstall uses the
  fresh UDID instead of stale closure state
- Add explicit /wisp/ location in nginx.conf returning 502 to prevent
  SPA fallback from swallowing websocket upgrades
- Add prefers-color-scheme dark mode via CSS custom property overrides;
  replace hardcoded rgba/hex with color-mix() for automatic adaptation

nginx.conf

@@ -44,6 +44,12 @@ server {
         add_header Cache-Control "no-cache" always;
     }
 
+    # WISP websocket — must be proxied by an outer reverse proxy or sidecar.
+    # Return 502 so the frontend gets a clear signal rather than the SPA shell.
+    location /wisp/ {
+        return 502;
+    }
+
     # Hash routing (no server-side routes needed) — fall back to index.html.
     location / {
         try_files $uri $uri/ /index.html;