dashboard: M4TR1X → tab strip entry for matrix GUI (#607)

Frontend half of #607 v0 — adds the `◆ M4TR1X ◆ →` page-link entry
to the dashboard tab strip between SCH3DUL3S and FL0W →. Same
`tab-link` class as FL0W → since /matrix/ is its own SPA, not an
in-place pane swap.

Hidden via the `hidden` attribute by default; tabs.js's `refreshState`
flips it based on `s.matrix_gui_enabled` (added in #610). When the
operator hasn't set `hyperhive.matrix.gui.enable = true` the snapshot
returns false and the tab strip doesn't surface a dead link.

docs/web-ui.md updated:
- chrome-header tab-strip list now includes M4TR1X → with the
  hidden-when-disabled note
- new "M4TR1X page" section under FL0W explaining the same-origin
  serve via hive-c0re ServeDir + the manual homeserver URL pick on
  first login (with #609 tracking the post-#15 nginx-front re-root +
  .well-known/matrix/client auto-discovery)

docs/web-ui.md

@@ -140,10 +140,15 @@ cross-page link (`◆ FL0W ◆ →`), not a pane swap.
 
 **Chrome header** (fixed, overlays the active tab pane):
 - **Tab strip**: `◆ SW4RM ◆`, `◆ Y3R C4LL ◆`, `◆ SYST3M ◆`,
-  `◆ SCH3DUL3S ◆`, and `◆ FL0W ◆ →` (page link). Count pills on
-  SW4RM (container count), Y3R C4LL (pending approvals +
-  questions), and SCH3DUL3S (active schedules); FL0W pill mirrors
-  the operator inbox length (hidden when zero).
+  `◆ SCH3DUL3S ◆`, `◆ M4TR1X ◆ →` (optional page link, see below),
+  and `◆ FL0W ◆ →` (page link). Count pills on SW4RM (container
+  count), Y3R C4LL (pending approvals + questions), and SCH3DUL3S
+  (active schedules); FL0W pill mirrors the operator inbox length
+  (hidden when zero). The M4TR1X → entry is hidden when
+  `hyperhive.matrix.gui.enable = false` (default) so operators
+  without the matrix GUI on don't see a dead link — tabs.js gates
+  the `hidden` attribute on `state.matrix_gui_enabled` from
+  `/api/state` (#607).
 - **Notification controls**: `🔔 enable notifications` when
   permission ungranted; `🔕 mute / 🔔 unmute` toggle once granted.
   Always visible in the chrome regardless of active tab.
@@ -300,6 +305,24 @@ button hard-deletes (`POST /cancel-reminder/{id}`) and a
 Lives in the SCH3DUL3S tab alongside operator schedules so the
 operator has one place for everything time-fired (#460).
 
+### M4TR1X page (`/matrix/`, optional)
+
+A static matrix web client (default `pkgs.fluffychat-web`, swappable
+via `hyperhive.matrix.gui.package`) mounted by hive-c0re's dashboard
+router as a sibling `nest_service("/matrix", ServeDir::new(dir))`
+when `hyperhive.matrix.gui.enable = true` + `HIVE_MATRIX_GUI_DIR` env
+points at the dist root. Same-origin with the dashboard; the
+operator opens `/matrix/` in the same tab from the M4TR1X → strip
+entry, logs in once with the in-host tuwunel homeserver URL
+(`http://localhost:8008` or whatever the matrix module exposes),
+then has matrix chat alongside the agent dashboard without leaving
+the host's origin.
+
+v0 same-origin shape via hive-c0re ServeDir (#607 / #610); the
+unified nginx-front re-root to `https://matrix.${hyperhive.domain}`
++ `.well-known/matrix/client` auto-discovery is tracked in #609
+(atlas's lane, post-#15).
+
 ### FL0W page (`/flow.html`)
 
 A dedicated full-page terminal (not a tab pane — a separate HTML

frontend/packages/dashboard/src/index.html

@@ -45,6 +45,18 @@
         <span class="tab-count" id="tab-count-schedules" hidden></span>
       </a>
 
+      <!-- M4TR1X (#607): optional matrix web client (fluffychat-web by
+           default) mounted at /matrix/ by hive-c0re's dashboard router
+           when `hyperhive.matrix.gui.enable = true`. Same-origin same-
+           tab navigation (the static dist is its own SPA). Hidden in JS
+           when `state.matrix_gui_enabled === false` so operators without
+           matrix-gui on don't see a dead link (#609 covers the
+           post-#15 nginx-front re-root + .well-known auto-discovery). -->
+      <a class="tab tab-link" id="tab-matrix" href="/matrix/" hidden
+         title="open the matrix chat client (fluffychat-web)">
+        <span class="tab-label">◆ M4TR1X ◆ →</span>
+      </a>
+
       <!-- FL0W is its own page (`/flow.html`), not a tab — per
            operator @ #369#issuecomment-3437 ("yes terminal can be a
            separate page"). The link lives in the tab strip so it

frontend/packages/dashboard/src/tabs.js

@@ -3020,6 +3020,12 @@ window.marked = marked;
       // synchronous read (e.g. the compose autocomplete pulls agent
       // names from here instead of refetching on every keystroke).
       window.__hyperhive_state = s;
+      // #607: surface the M4TR1X → tab strip entry only when the
+      // backend's HIVE_MATRIX_GUI_DIR mount is live (otherwise
+      // clicking would 404). `state.matrix_gui_enabled` flips when
+      // the operator toggles `hyperhive.matrix.gui.enable` and rebuilds.
+      const matrixTab = $('tab-matrix');
+      if (matrixTab) matrixTab.hidden = !s.matrix_gui_enabled;
       const openDetails = snapshotOpenDetails();
       // Sync transients + containers first so renderContainers below
       // sees the current derived maps (it reads from