feat: live SSE updates for P3RM1SS10NS tab (capabilities + tool groups)

Add CapabilitiesChanged and ToolGroupsChanged DashboardEvent variants
so the P3RM1SS10NS tab reflects perm changes without the operator
navigating away and back.

Backend:
- DashboardEvent::CapabilitiesChanged { seq, caps, descriptions,
  assignments } — same payload shape as GET /api/capabilities
- DashboardEvent::ToolGroupsChanged { seq, groups, descriptions,
  assignments } — same payload shape as GET /api/tool-groups
- Coordinator::emit_capabilities_snapshot() and
  emit_tool_groups_snapshot() — read from the JSON files and broadcast
- rebuild_queue.rs PermChange worker: emit after each successful
  commit_capabilities / commit_tool_groups call

Frontend:
- applyCapabilitiesChanged(ev): calls renderCapabilities(root, ev)
- applyToolGroupsChanged(ev): calls renderToolGroups(root, ev)
- Both registered in MUTATION_HANDLERS
- activateTab comment updated (SSE now covers perm changes)

Docs: dashboard.md and CLAUDE.md updated.

This completes SSE coverage for all dashboard sections: SW4RM,
Y3R C4LL, SYST3M, SCH3DUL3S/reminders, and P3RM1SS10NS all
derive live updates from /dashboard/stream.

frontend/packages/dashboard/src/tabs.js

@@ -1227,7 +1227,19 @@ window.marked = marked;
   // ── tool-groups (permissions) table ─────────────────────────────────────
   // Fetched from GET /api/tool-groups on system tab activation and after
   // each save. Groups (columns) come from the backend so the UI doesn't
-  // need updating when a new group is added.
+  // need updating when a new group is added. Live updates via
+  // `capabilities_changed` / `tool_groups_changed` SSE events fired
+  // after the rebuild-queue worker commits the perm JSON file.
+  function applyCapabilitiesChanged(ev) {
+    const root = $('capabilities-section');
+    if (!root) return;
+    renderCapabilities(root, ev);
+  }
+  function applyToolGroupsChanged(ev) {
+    const root = $('tool-groups-section');
+    if (!root) return;
+    renderToolGroups(root, ev);
+  }
 
   async function fetchAndRenderCapabilities() {
     const root = $('capabilities-section');
@@ -3607,6 +3619,8 @@ window.marked = marked;
     rebuild_queue_changed:   applyRebuildQueueChanged,
     schedules_changed:       applySchedulesChanged,
     reminders_changed:       applyRemindersChanged,
+    capabilities_changed:    applyCapabilitiesChanged,
+    tool_groups_changed:     applyToolGroupsChanged,
   };
   (function bindDashboardStream() {
     // Route through the SharedWorker so all open hyperhive tabs share
@@ -3667,8 +3681,10 @@ window.marked = marked;
     // re-fetch reminders on SCH3DUL3S activation since both sections
     // live on the same tab.
     if (target === 'schedules') { refreshSchedules(); refreshReminders(); }
-    // Permissions tables (capabilities + tool-groups) have no SSE channel;
-    // fetch both on each activation so the operator sees fresh data.
+    // Permissions tables: SSE covers worker-applied changes
+    // (capabilities_changed / tool_groups_changed); re-fetch on
+    // activation as a safety net for any gap between SSE events and
+    // the cold-load snapshot.
     if (target === 'permissions') {
       fetchAndRenderCapabilities();
       fetchAndRenderToolGroups();