feat(#1053): permissions tab — capabilities UI + move tool-groups

Add a new P3RM1SS10NS tab to the dashboard that consolidates all
per-agent permission configuration:

Backend:
- GET /api/capabilities returns { caps: [...], assignments: {...} }
  driven by Capability::ALL variants (manage_root_agent,
  read_host_journal, query_agent_state)
- POST /api/capabilities/{agent} writes capabilities.json and queues
  a rebuild so HIVE_CAPABILITIES takes effect

Frontend:
- New 'permissions' entry in TABS, placed after 'system'
- P3RM1SS10NS tab pane with two sections:
  C4P4B1L1T13S — agents × capabilities checkbox matrix (.cap-*)
  T00L GR0UPS — agents × tool-groups checkbox matrix (.tg-*) moved
    from SYST3M tab
- activateTab('permissions') fetches both tables; neither has an SSE
  channel so they re-fetch on each activation to stay fresh
- CSS for .cap-* mirrors the .tg-* layout (scrollable, Catppuccin)

frontend/packages/dashboard/src/index.html

@@ -37,6 +37,14 @@
         <span class="tab-label">◆ SYST3M ◆</span>
         <span class="tab-count" id="tab-count-system" hidden></span>
       </a>
+      <!-- P3RM1SS10NS: per-agent capability grants and tool-group
+           assignments. Both tables are fetched on tab activation. -->
+      <a class="tab" id="tab-permissions" href="#permissions" role="tab"
+         aria-controls="tab-pane-permissions"
+         data-tab="permissions">
+        <span class="tab-label">◆ P3RM1SS10NS ◆</span>
+      </a>
+
       <!-- SCH3DUL3S: scheduled-prompts surface. List of queued
            schedules + an operator-direct creation form. Count pill
            mirrors the active (non-cancelled) schedule count; hidden
@@ -172,6 +180,22 @@
         <p class="meta">loading…</p>
       </div>
 
+    </section>
+
+    <!-- P3RM1SS10NS: per-agent capability grants + tool-group
+         assignments. Both tables are column-driven from the backend
+         (GET /api/capabilities, GET /api/tool-groups) so new entries
+         require no UI change. Saving POSTs to the respective
+         /{agent} endpoint and queues a rebuild. -->
+    <section class="tab-pane" id="tab-pane-permissions"
+             role="tabpanel" aria-labelledby="tab-permissions">
+      <h2>◆ C4P4B1L1T13S ◆</h2>
+      <div class="divider">══════════════════════════════════════════════════════════════</div>
+      <p class="meta">per-agent capability grants. capabilities unlock gated MCP tools and system access. saving queues a rebuild for the affected agent.</p>
+      <div id="capabilities-section">
+        <p class="meta">loading…</p>
+      </div>
+
       <!-- T00L GR0UPS: per-agent tool-group permission matrix. Rows = agents,
            cols = tool groups fetched from GET /api/tool-groups.
            Checking / unchecking and saving POSTs to