feat(#1053): permissions tab — capabilities UI + move tool-groups

Add a new P3RM1SS10NS tab to the dashboard that consolidates all
per-agent permission configuration:

Backend:
- GET /api/capabilities returns { caps: [...], assignments: {...} }
  driven by Capability::ALL variants (manage_root_agent,
  read_host_journal, query_agent_state)
- POST /api/capabilities/{agent} writes capabilities.json and queues
  a rebuild so HIVE_CAPABILITIES takes effect

Frontend:
- New 'permissions' entry in TABS, placed after 'system'
- P3RM1SS10NS tab pane with two sections:
  C4P4B1L1T13S — agents × capabilities checkbox matrix (.cap-*)
  T00L GR0UPS — agents × tool-groups checkbox matrix (.tg-*) moved
    from SYST3M tab
- activateTab('permissions') fetches both tables; neither has an SSE
  channel so they re-fetch on each activation to stay fresh
- CSS for .cap-* mirrors the .tg-* layout (scrollable, Catppuccin)

frontend/packages/dashboard/src/dashboard.css

@@ -2047,8 +2047,57 @@ body.logs-shell {
   font-size: 0.85em;
 }
 
+/* ─── capabilities (permissions) table ─────────────────────────────
+   Agents × capabilities matrix in the P3RM1SS10NS tab. Same layout
+   as the tool-groups table below. Horizontally scrollable on narrow
+   viewports. */
+.cap-table-wrap {
+  overflow-x: auto;
+  margin-top: 0.5em;
+}
+.cap-table {
+  border-collapse: collapse;
+  font-size: 0.82em;
+  min-width: 100%;
+}
+.cap-table th,
+.cap-table td {
+  padding: 0.35em 0.6em;
+  border: 1px solid var(--border);
+  text-align: center;
+  vertical-align: middle;
+}
+.cap-table thead th {
+  background: var(--bg-elev);
+  color: var(--muted);
+  letter-spacing: 0.05em;
+  white-space: nowrap;
+}
+.cap-agent-col {
+  text-align: left !important;
+  min-width: 8em;
+}
+.cap-agent-name {
+  color: var(--fg);
+  font-weight: 600;
+}
+.cap-cb {
+  cursor: pointer;
+  width: 1em;
+  height: 1em;
+  accent-color: var(--purple);
+}
+.cap-save-btn {
+  font-size: 0.78em;
+  padding: 0.2em 0.6em;
+  white-space: nowrap;
+}
+.cap-row:hover td {
+  background: var(--bg-elev);
+}
+
 /* ─── tool-groups (permissions) table ──────────────────────────────
-   Agents × tool-groups matrix in the SYST3M tab. Horizontally
+   Agents × tool-groups matrix in the P3RM1SS10NS tab. Horizontally
    scrollable on narrow viewports. */
 .tg-table-wrap {
   overflow-x: auto;