feat: live SSE updates for P3RM1SS10NS tab (capabilities + tool groups)

Add CapabilitiesChanged and ToolGroupsChanged DashboardEvent variants
so the P3RM1SS10NS tab reflects perm changes without the operator
navigating away and back.

Backend:
- DashboardEvent::CapabilitiesChanged { seq, caps, descriptions,
  assignments } — same payload shape as GET /api/capabilities
- DashboardEvent::ToolGroupsChanged { seq, groups, descriptions,
  assignments } — same payload shape as GET /api/tool-groups
- Coordinator::emit_capabilities_snapshot() and
  emit_tool_groups_snapshot() — read from the JSON files and broadcast
- rebuild_queue.rs PermChange worker: emit after each successful
  commit_capabilities / commit_tool_groups call

Frontend:
- applyCapabilitiesChanged(ev): calls renderCapabilities(root, ev)
- applyToolGroupsChanged(ev): calls renderToolGroups(root, ev)
- Both registered in MUTATION_HANDLERS
- activateTab comment updated (SSE now covers perm changes)

Docs: dashboard.md and CLAUDE.md updated.

This completes SSE coverage for all dashboard sections: SW4RM,
Y3R C4LL, SYST3M, SCH3DUL3S/reminders, and P3RM1SS10NS all
derive live updates from /dashboard/stream.

hive-c0re/src/rebuild_queue.rs

@@ -770,11 +770,16 @@ async fn dispatch(
                     crate::meta::commit_tool_groups(name, groups)
                         .await
                         .with_context(|| format!("commit tool-groups for {name}"))?;
+                    // Emit after the commit so the P3RM1SS10NS tab
+                    // reflects the new assignment without the operator
+                    // needing to navigate away and back.
+                    coord.emit_tool_groups_snapshot();
                 }
                 Some(PermPayload::Capabilities { caps }) => {
                     crate::meta::commit_capabilities(name, caps)
                         .await
                         .with_context(|| format!("commit capabilities for {name}"))?;
+                    coord.emit_capabilities_snapshot();
                 }
                 None => {
                     anyhow::bail!(