feat: live SSE updates for P3RM1SS10NS tab (capabilities + tool groups)

Add CapabilitiesChanged and ToolGroupsChanged DashboardEvent variants
so the P3RM1SS10NS tab reflects perm changes without the operator
navigating away and back.

Backend:
- DashboardEvent::CapabilitiesChanged { seq, caps, descriptions,
  assignments } — same payload shape as GET /api/capabilities
- DashboardEvent::ToolGroupsChanged { seq, groups, descriptions,
  assignments } — same payload shape as GET /api/tool-groups
- Coordinator::emit_capabilities_snapshot() and
  emit_tool_groups_snapshot() — read from the JSON files and broadcast
- rebuild_queue.rs PermChange worker: emit after each successful
  commit_capabilities / commit_tool_groups call

Frontend:
- applyCapabilitiesChanged(ev): calls renderCapabilities(root, ev)
- applyToolGroupsChanged(ev): calls renderToolGroups(root, ev)
- Both registered in MUTATION_HANDLERS
- activateTab comment updated (SSE now covers perm changes)

Docs: dashboard.md and CLAUDE.md updated.

This completes SSE coverage for all dashboard sections: SW4RM,
Y3R C4LL, SYST3M, SCH3DUL3S/reminders, and P3RM1SS10NS all
derive live updates from /dashboard/stream.

hive-c0re/src/coordinator.rs

@@ -407,6 +407,44 @@ impl Coordinator {
         });
     }
 
+    /// Emit a `CapabilitiesChanged` snapshot event. Called from the
+    /// rebuild-queue worker after a `PermChange` / Capabilities entry
+    /// commits the JSON file, so the P3RM1SS10NS tab updates live.
+    pub fn emit_capabilities_snapshot(self: &Arc<Self>) {
+        use hive_sh4re::Capability;
+        let caps = Capability::ALL.iter().map(|c| c.as_str()).collect();
+        let descriptions = Capability::ALL
+            .iter()
+            .map(|c| (c.as_str(), c.description()))
+            .collect();
+        let assignments = crate::capabilities::read();
+        self.emit_dashboard_event(DashboardEvent::CapabilitiesChanged {
+            seq: self.next_seq(),
+            caps,
+            descriptions,
+            assignments,
+        });
+    }
+
+    /// Emit a `ToolGroupsChanged` snapshot event. Called from the
+    /// rebuild-queue worker after a `PermChange` / ToolGroups entry
+    /// commits the JSON file, so the P3RM1SS10NS tab updates live.
+    pub fn emit_tool_groups_snapshot(self: &Arc<Self>) {
+        use hive_sh4re::ToolGroup;
+        let groups = ToolGroup::ALL.iter().map(|g| g.as_str()).collect();
+        let descriptions = ToolGroup::ALL
+            .iter()
+            .map(|g| (g.as_str(), g.description()))
+            .collect();
+        let assignments = crate::tool_groups::read();
+        self.emit_dashboard_event(DashboardEvent::ToolGroupsChanged {
+            seq: self.next_seq(),
+            groups,
+            descriptions,
+            assignments,
+        });
+    }
+
     /// Update the `step` label on a running queue entry and (if it
     /// actually changed) re-emit the queue snapshot so the dashboard
     /// renders the new phase. Returns `true` when the label was new