feat: live SSE updates for P3RM1SS10NS tab (capabilities + tool groups)

Add CapabilitiesChanged and ToolGroupsChanged DashboardEvent variants
so the P3RM1SS10NS tab reflects perm changes without the operator
navigating away and back.

Backend:
- DashboardEvent::CapabilitiesChanged { seq, caps, descriptions,
  assignments } — same payload shape as GET /api/capabilities
- DashboardEvent::ToolGroupsChanged { seq, groups, descriptions,
  assignments } — same payload shape as GET /api/tool-groups
- Coordinator::emit_capabilities_snapshot() and
  emit_tool_groups_snapshot() — read from the JSON files and broadcast
- rebuild_queue.rs PermChange worker: emit after each successful
  commit_capabilities / commit_tool_groups call

Frontend:
- applyCapabilitiesChanged(ev): calls renderCapabilities(root, ev)
- applyToolGroupsChanged(ev): calls renderToolGroups(root, ev)
- Both registered in MUTATION_HANDLERS
- activateTab comment updated (SSE now covers perm changes)

Docs: dashboard.md and CLAUDE.md updated.

This completes SSE coverage for all dashboard sections: SW4RM,
Y3R C4LL, SYST3M, SCH3DUL3S/reminders, and P3RM1SS10NS all
derive live updates from /dashboard/stream.

CLAUDE.md

@@ -83,7 +83,8 @@ hive-c0re/         host daemon + sibling operator CLI (lib + 2 bins)
                          `QuestionAdded` / `QuestionResolved`,
                          `TransientSet` / `TransientCleared`,
                          `RebuildQueueChanged`, `SchedulesChanged`,
-                         `RemindersChanged`).
+                         `RemindersChanged`, `CapabilitiesChanged`,
+                         `ToolGroupsChanged`).
                          Each frame carries a
                          monotonic per-process `seq` clients use to
                          dedupe against snapshot reads.