dashboard: M4TR1X → tab strip entry for matrix GUI (#607)

Frontend half of #607 v0 — adds the `◆ M4TR1X ◆ →` page-link entry
to the dashboard tab strip between SCH3DUL3S and FL0W →. Same
`tab-link` class as FL0W → since /matrix/ is its own SPA, not an
in-place pane swap.

Hidden via the `hidden` attribute by default; tabs.js's `refreshState`
flips it based on `s.matrix_gui_enabled` (added in #610). When the
operator hasn't set `hyperhive.matrix.gui.enable = true` the snapshot
returns false and the tab strip doesn't surface a dead link.

docs/web-ui.md updated:
- chrome-header tab-strip list now includes M4TR1X → with the
  hidden-when-disabled note
- new "M4TR1X page" section under FL0W explaining the same-origin
  serve via hive-c0re ServeDir + the manual homeserver URL pick on
  first login (with #609 tracking the post-#15 nginx-front re-root +
  .well-known/matrix/client auto-discovery)

frontend/packages/dashboard/src/index.html

@@ -45,6 +45,18 @@
         <span class="tab-count" id="tab-count-schedules" hidden></span>
       </a>
 
+      <!-- M4TR1X (#607): optional matrix web client (fluffychat-web by
+           default) mounted at /matrix/ by hive-c0re's dashboard router
+           when `hyperhive.matrix.gui.enable = true`. Same-origin same-
+           tab navigation (the static dist is its own SPA). Hidden in JS
+           when `state.matrix_gui_enabled === false` so operators without
+           matrix-gui on don't see a dead link (#609 covers the
+           post-#15 nginx-front re-root + .well-known auto-discovery). -->
+      <a class="tab tab-link" id="tab-matrix" href="/matrix/" hidden
+         title="open the matrix chat client (fluffychat-web)">
+        <span class="tab-label">◆ M4TR1X ◆ →</span>
+      </a>
+
       <!-- FL0W is its own page (`/flow.html`), not a tab — per
            operator @ #369#issuecomment-3437 ("yes terminal can be a
            separate page"). The link lives in the tab strip so it

frontend/packages/dashboard/src/tabs.js

@@ -3020,6 +3020,12 @@ window.marked = marked;
       // synchronous read (e.g. the compose autocomplete pulls agent
       // names from here instead of refetching on every keystroke).
       window.__hyperhive_state = s;
+      // #607: surface the M4TR1X → tab strip entry only when the
+      // backend's HIVE_MATRIX_GUI_DIR mount is live (otherwise
+      // clicking would 404). `state.matrix_gui_enabled` flips when
+      // the operator toggles `hyperhive.matrix.gui.enable` and rebuilds.
+      const matrixTab = $('tab-matrix');
+      if (matrixTab) matrixTab.hidden = !s.matrix_gui_enabled;
       const openDetails = snapshotOpenDetails();
       // Sync transients + containers first so renderContainers below
       // sees the current derived maps (it reads from