feat: live SSE updates for P3RM1SS10NS tab (capabilities + tool groups)

Add CapabilitiesChanged and ToolGroupsChanged DashboardEvent variants
so the P3RM1SS10NS tab reflects perm changes without the operator
navigating away and back.

Backend:
- DashboardEvent::CapabilitiesChanged { seq, caps, descriptions,
  assignments } — same payload shape as GET /api/capabilities
- DashboardEvent::ToolGroupsChanged { seq, groups, descriptions,
  assignments } — same payload shape as GET /api/tool-groups
- Coordinator::emit_capabilities_snapshot() and
  emit_tool_groups_snapshot() — read from the JSON files and broadcast
- rebuild_queue.rs PermChange worker: emit after each successful
  commit_capabilities / commit_tool_groups call

Frontend:
- applyCapabilitiesChanged(ev): calls renderCapabilities(root, ev)
- applyToolGroupsChanged(ev): calls renderToolGroups(root, ev)
- Both registered in MUTATION_HANDLERS
- activateTab comment updated (SSE now covers perm changes)

Docs: dashboard.md and CLAUDE.md updated.

This completes SSE coverage for all dashboard sections: SW4RM,
Y3R C4LL, SYST3M, SCH3DUL3S/reminders, and P3RM1SS10NS all
derive live updates from /dashboard/stream.

hive-c0re/src/dashboard_events.rs

@@ -210,6 +210,32 @@ pub enum DashboardEvent {
         seq: u64,
         reminders: Vec<crate::broker::PendingReminder>,
     },
+    /// Full snapshot of capability grants (per-agent `Vec<cap_name>`).
+    /// Emitted from the rebuild-queue worker after a `PermChange`
+    /// `Capabilities` entry commits the JSON file. Lets the P3RM1SS10NS
+    /// tab update live when the worker applies a queued change.
+    CapabilitiesChanged {
+        seq: u64,
+        /// Ordered list of all known capability names (column headers).
+        caps: Vec<&'static str>,
+        /// Short description for each capability name (tooltip).
+        descriptions: std::collections::BTreeMap<&'static str, &'static str>,
+        /// Per-agent capability grant map; absent agents have no extra caps.
+        assignments: std::collections::BTreeMap<String, Vec<String>>,
+    },
+    /// Full snapshot of tool-group assignments (per-agent `Vec<group_name>`).
+    /// Emitted from the rebuild-queue worker after a `PermChange`
+    /// `ToolGroups` entry commits the JSON file. Lets the P3RM1SS10NS
+    /// tab update live when the worker applies a queued change.
+    ToolGroupsChanged {
+        seq: u64,
+        /// Ordered list of all known tool-group names (column headers).
+        groups: Vec<&'static str>,
+        /// Short description for each group name (tooltip).
+        descriptions: std::collections::BTreeMap<&'static str, &'static str>,
+        /// Per-agent assignment map; absent agents use the role default.
+        assignments: std::collections::BTreeMap<String, Vec<String>>,
+    },
 }
 
 impl DashboardEvent {
@@ -242,6 +268,8 @@ impl DashboardEvent {
             DashboardEvent::RebuildQueueChanged { .. } => "rebuild_queue_changed",
             DashboardEvent::SchedulesChanged { .. } => "schedules_changed",
             DashboardEvent::RemindersChanged { .. } => "reminders_changed",
+            DashboardEvent::CapabilitiesChanged { .. } => "capabilities_changed",
+            DashboardEvent::ToolGroupsChanged { .. } => "tool_groups_changed",
         }
     }
 }
@@ -368,6 +396,18 @@ mod tests {
                 seq: 1,
                 reminders: Vec::new(),
             },
+            DashboardEvent::CapabilitiesChanged {
+                seq: 1,
+                caps: Vec::new(),
+                descriptions: std::collections::BTreeMap::new(),
+                assignments: std::collections::BTreeMap::new(),
+            },
+            DashboardEvent::ToolGroupsChanged {
+                seq: 1,
+                groups: Vec::new(),
+                descriptions: std::collections::BTreeMap::new(),
+                assignments: std::collections::BTreeMap::new(),
+            },
         ];
         for ev in samples {
             let v: serde_json::Value = serde_json::to_value(&ev).expect("serialise");