dashboard: M4TR1X → tab strip entry for matrix GUI (#607)

Frontend half of #607 v0 — adds the `◆ M4TR1X ◆ →` page-link entry
to the dashboard tab strip between SCH3DUL3S and FL0W →. Same
`tab-link` class as FL0W → since /matrix/ is its own SPA, not an
in-place pane swap.

Hidden via the `hidden` attribute by default; tabs.js's `refreshState`
flips it based on `s.matrix_gui_enabled` (added in #610). When the
operator hasn't set `hyperhive.matrix.gui.enable = true` the snapshot
returns false and the tab strip doesn't surface a dead link.

docs/web-ui.md updated:
- chrome-header tab-strip list now includes M4TR1X → with the
  hidden-when-disabled note
- new "M4TR1X page" section under FL0W explaining the same-origin
  serve via hive-c0re ServeDir + the manual homeserver URL pick on
  first login (with #609 tracking the post-#15 nginx-front re-root +
  .well-known/matrix/client auto-discovery)

frontend/packages/dashboard/src/tabs.js

@@ -3020,6 +3020,12 @@ window.marked = marked;
       // synchronous read (e.g. the compose autocomplete pulls agent
       // names from here instead of refetching on every keystroke).
       window.__hyperhive_state = s;
+      // #607: surface the M4TR1X → tab strip entry only when the
+      // backend's HIVE_MATRIX_GUI_DIR mount is live (otherwise
+      // clicking would 404). `state.matrix_gui_enabled` flips when
+      // the operator toggles `hyperhive.matrix.gui.enable` and rebuilds.
+      const matrixTab = $('tab-matrix');
+      if (matrixTab) matrixTab.hidden = !s.matrix_gui_enabled;
       const openDetails = snapshotOpenDetails();
       // Sync transients + containers first so renderContainers below
       // sees the current derived maps (it reads from