docs: fix 3 more stale dashboard.rs refs argus caught in review

hive-c0re/src/dashboard.rs became a module directory
(hive-c0re/src/dashboard/) a while back; three more references to it
as a single file survived the #3281 sweep (conventions.md x2,
web-ui/shape.md's StateSnapshot pointer). Same bug class the sweep
was hunting for, argus caught it in review.

docs/conventions.md

@@ -408,7 +408,8 @@ bypass the operator approval gate.
 **Adding a new capability** — add a variant to `Capability` in
 `hive-sh4re/src/lib.rs` + an arm to `as_str`. Add it to `Capability::ALL` (the
 source of truth for the permissions UI columns). Implement the access check in
-the relevant handler (`agent_server.rs`, `mcp.rs`, or `dashboard.rs`).
+the relevant handler (`agent_server.rs`, `mcp.rs`, or a handler under
+`hive-c0re/src/dashboard/`).
 
 ## Async forms
 
@@ -441,7 +442,7 @@ sufficient to recover.
 ## Actions are factored
 
 `approve` / `deny` / `destroy` (and the lifecycle helper) live in
-`actions.rs` / `dashboard.rs`. The admin socket and the dashboard
+`actions.rs` / `hive-c0re/src/dashboard/`. The admin socket and the dashboard
 POST handlers both call into them so the two surfaces never drift.
 
 ## Commit messages

docs/web-ui/shape.md

@@ -198,7 +198,8 @@ listener: read `data-confirm`, swap the button to a spinner, POST
 `application/x-www-form-urlencoded`, re-enable the button on success
 (refreshState may keep the form mounted, so we don't rely on a
 re-render), call `refreshState()`. State shapes live in
-`dashboard.rs::StateSnapshot` and `web_ui/state.rs::StateSnapshot` — when
+`hive-c0re/src/dashboard/state_snapshot.rs::StateSnapshot` and
+`web_ui/state.rs::StateSnapshot` — when
 adding state fields, plumb through the snapshot struct and the
 relevant domain module (`assets/swarm.js`, `assets/call.js`, etc.) render function.