dashboard: terminal compose with @-mention sticky recipient

new section under MESS4GE FL0W. msgflow already tails only
broker traffic (sent + delivered), which is exactly the
'messages through core' view the operator wants; no
per-agent thinking leaks through. compose box below:

- a prompt span renders the sticky recipient ('@coder>'),
  rendered outside the textarea so it can't be edited
  inadvertently. on submit the recipient gets persisted to
  localStorage so it survives reload.
- start the input with '@name body' to redirect — the parser
  splits at the first whitespace and the new recipient
  becomes sticky.
- typing '@' at the start opens a completion dropdown over
  the textarea pulled from window.__hyperhive_state.containers;
  arrow keys cycle, tab/enter selects, escape closes. clicking
  works too.
- manager swap: agents flagged is_manager are surfaced as
  '@manager' (the broker's recipient string) instead of
  '@hm1nd' (the container name), so the message actually
  routes to the manager's inbox.

backend: new POST /op-send accepts {to, body} and drops a
broker.send({from:'operator', to, body}) — same shape as the
per-agent web UI's OperatorMsg, but lets the operator choose
the recipient explicitly from the main dashboard.

hive-c0re/src/dashboard.rs

@@ -56,6 +56,7 @@ pub async fn serve(port: u16, coord: Arc<Coordinator>) -> Result<()> {
         .route("/api/journal/{name}", get(get_journal))
         .route("/api/agent-config/{name}", get(get_agent_config))
         .route("/request-spawn", post(post_request_spawn))
+        .route("/op-send", post(post_op_send))
         .route("/messages/stream", get(messages_stream))
         .with_state(AppState { coord });
     let addr = SocketAddr::from(([0, 0, 0, 0], port));
@@ -708,6 +709,38 @@ async fn post_purge_tombstone(
     }
 }
 
+/// Operator-side compose form on the dashboard terminal. Drops a
+/// message into the broker as `{from: "operator", to, body}`. Same
+/// shape that per-agent web UIs use via `OperatorMsg`, but here the
+/// operator picks the recipient explicitly with `@name`. No
+/// validation that `to` resolves to a known agent — broker accepts
+/// arbitrary recipients (and the agent's inbox grows whether or not
+/// they exist, which is fine for spawn-then-greet flows).
+#[derive(Deserialize)]
+struct OpSendForm {
+    to: String,
+    body: String,
+}
+
+async fn post_op_send(State(state): State<AppState>, Form(form): Form<OpSendForm>) -> Response {
+    let to = form.to.trim().to_owned();
+    let body = form.body.trim().to_owned();
+    if to.is_empty() {
+        return error_response("op-send: `to` required");
+    }
+    if body.is_empty() {
+        return error_response("op-send: `body` required");
+    }
+    if let Err(e) = state.coord.broker.send(&hive_sh4re::Message {
+        from: hive_sh4re::OPERATOR_RECIPIENT.to_owned(),
+        to: to.clone(),
+        body,
+    }) {
+        return error_response(&format!("op-send to {to} failed: {e:#}"));
+    }
+    Redirect::to("/").into_response()
+}
+
 async fn post_request_spawn(
     State(state): State<AppState>,
     Form(form): Form<RequestSpawnForm>,