feat(#1005): capabilities UI — per-agent tool-group table in SYST3M tab

Backend (hive-c0re/src/dashboard.rs):
  GET /api/tool-groups  — returns { groups: [...], assignments: {...} };
    groups list comes from ToolGroup::ALL so the UI needs no change when
    a new group is added (satisfies the 'no extend ui' requirement)
  POST /api/tool-groups/{agent} — accepts { groups: [...] }, calls
    set_groups() then enqueues a rebuild so the new HIVE_TOOL_GROUPS
    env var takes effect immediately

hive-sh4re/src/lib.rs:
  Added ToolGroup::ALL const (ordered slice of every group)
  Added ToolGroup::as_str() — snake_case wire name, matches serde

Frontend:
  SYST3M tab: new C4P4B1L1T13S section above K3PT ST4T3 with
    #capabilities-section placeholder
  tabs.js: fetchAndRenderCapabilities() + renderCapabilities() —
    columns are built from the groups array returned by the API;
    each row has one checkbox per group and a save button that POSTs
    and re-fetches after 800ms; agents without explicit assignments
    show a (default) label; triggered on each SYST3M tab activation
  dashboard.css: .cap-table-wrap/.cap-table/.cap-row/.cap-agent-*
    styles for the scrollable matrix table

frontend/packages/dashboard/src/dashboard.css

@@ -2045,6 +2045,58 @@ body.logs-shell {
   font-size: 0.85em;
 }
 
+/* ─── capabilities (tool-group) table ──────────────────────────────
+   Agents × tool-groups matrix in the SYST3M tab. Horizontally
+   scrollable on narrow viewports. */
+.cap-table-wrap {
+  overflow-x: auto;
+  margin-top: 0.5em;
+}
+.cap-table {
+  border-collapse: collapse;
+  font-size: 0.82em;
+  min-width: 100%;
+}
+.cap-table th,
+.cap-table td {
+  padding: 0.35em 0.6em;
+  border: 1px solid var(--border);
+  text-align: center;
+  vertical-align: middle;
+}
+.cap-table thead th {
+  background: var(--bg-elev);
+  color: var(--muted);
+  letter-spacing: 0.05em;
+  white-space: nowrap;
+}
+.cap-agent-col {
+  text-align: left !important;
+  min-width: 8em;
+}
+.cap-agent-name {
+  color: var(--fg);
+  font-weight: 600;
+}
+.cap-default-label {
+  margin-left: 0.4em;
+  font-size: 0.85em;
+}
+.cap-cb {
+  cursor: pointer;
+  width: 1em;
+  height: 1em;
+  accent-color: var(--purple);
+}
+.cap-save-btn {
+  font-size: 0.78em;
+  padding: 0.2em 0.6em;
+  white-space: nowrap;
+}
+.cap-row:hover td {
+  background: var(--bg-elev);
+}
+
 /* ─── scheduled prompts tab ────────────────────────────────────────
    Creation form at the top, list of queued schedule cards below.
    Cards show: id + source + due-in + cancel-all in the header,

frontend/packages/dashboard/src/index.html

@@ -171,6 +171,18 @@
       <div id="tombstones-section">
         <p class="meta">loading…</p>
       </div>
+
+      <!-- C4P4B1L1T13S: per-agent tool-group matrix. Rows = agents,
+           cols = tool groups fetched from GET /api/tool-groups.
+           Checking / unchecking and saving POSTs to
+           /api/tool-groups/{agent}; a rebuild is queued automatically.
+           Absent agents default to the role default (shown in parens). -->
+      <h2>◆ C4P4B1L1T13S ◆</h2>
+      <div class="divider">══════════════════════════════════════════════════════════════</div>
+      <p class="meta">per-agent tool-group assignments. columns are filled from the backend — adding a new group requires no UI change. agents without an explicit entry use the role default (agents: messaging, meta, inbox, execution; manager: all). saving queues a rebuild.</p>
+      <div id="capabilities-section">
+        <p class="meta">loading…</p>
+      </div>
     </section>
 
     <!-- P33RS: peer hive link cards. Rendered from state.peer_hives;

frontend/packages/dashboard/src/tabs.js

@@ -1204,6 +1204,133 @@ window.marked = marked;
     root.append(ul);
   }
 
+  // ── capabilities (tool-group) table ──────────────────────────────────────
+  // Fetched from GET /api/tool-groups on system tab activation and after
+  // each save. Groups (columns) come from the backend so the UI doesn't
+  // need updating when a new group is added.
+
+  async function fetchAndRenderCapabilities() {
+    const root = $('capabilities-section');
+    if (!root) return;
+    root.innerHTML = '';
+    root.append(el('p', { class: 'meta' }, 'loading…'));
+    try {
+      const resp = await fetch('/api/tool-groups');
+      if (!resp.ok) throw new Error('HTTP ' + resp.status);
+      const data = await resp.json();
+      renderCapabilities(root, data);
+    } catch (err) {
+      root.innerHTML = '';
+      root.append(el('p', { class: 'meta' }, 'fetch failed: ' + err));
+    }
+  }
+
+  function renderCapabilities(root, data) {
+    root.innerHTML = '';
+    const { groups, assignments } = data;
+    if (!groups || !groups.length) {
+      root.append(el('p', { class: 'meta' }, '(no tool groups defined)'));
+      return;
+    }
+
+    // Agent names: union of live containers + keys already in assignments,
+    // sorted alphabetically.
+    const agentNames = [...new Set([
+      ...Array.from(containersState.keys()),
+      ...Object.keys(assignments),
+    ])].sort();
+
+    if (!agentNames.length) {
+      root.append(el('p', { class: 'meta' }, '(no agents)'));
+      return;
+    }
+
+    const wrap = el('div', { class: 'cap-table-wrap' });
+    const table = el('table', { class: 'cap-table' });
+
+    // Header row.
+    const thead = el('thead');
+    const hrow = el('tr');
+    hrow.append(el('th', { class: 'cap-agent-col' }, 'agent'));
+    for (const g of groups) {
+      hrow.append(el('th', { class: 'cap-group-col', title: g }, g));
+    }
+    hrow.append(el('th', { class: 'cap-save-col' }, ''));
+    thead.append(hrow);
+    table.append(thead);
+
+    const tbody = el('tbody');
+    for (const name of agentNames) {
+      // Explicit assignment or empty = using role default.
+      const assigned = assignments[name] || [];
+      const hasExplicit = Object.prototype.hasOwnProperty.call(assignments, name);
+      const tr = el('tr', { class: 'cap-row' });
+
+      // Agent name cell.
+      const nameTd = el('td', { class: 'cap-agent-col' });
+      nameTd.append(el('span', { class: 'cap-agent-name' }, name));
+      if (!hasExplicit) {
+        nameTd.append(el('span', { class: 'meta cap-default-label' }, '(default)'));
+      }
+      tr.append(nameTd);
+
+      // One checkbox per group.
+      const checkboxes = [];
+      for (const g of groups) {
+        const checked = assigned.includes(g);
+        const td = el('td', { class: 'cap-group-col' });
+        const cb = el('input', {
+          type: 'checkbox',
+          class: 'cap-cb',
+          'data-group': g,
+          'aria-label': g,
+        });
+        cb.checked = checked;
+        td.append(cb);
+        tr.append(td);
+        checkboxes.push(cb);
+      }
+
+      // Save button cell.
+      const saveTd = el('td', { class: 'cap-save-col' });
+      const saveBtn = el('button', { type: 'button', class: 'btn cap-save-btn' }, 'save');
+      saveBtn.addEventListener('click', async () => {
+        const selectedGroups = checkboxes
+          .filter((cb) => cb.checked)
+          .map((cb) => cb.dataset.group);
+        saveBtn.disabled = true;
+        saveBtn.textContent = '…';
+        try {
+          const r = await fetch('/api/tool-groups/' + encodeURIComponent(name), {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ groups: selectedGroups }),
+          });
+          if (!r.ok) {
+            const txt = await r.text();
+            saveBtn.textContent = 'err';
+            saveBtn.title = txt;
+          } else {
+            saveBtn.textContent = '✓';
+            setTimeout(() => fetchAndRenderCapabilities(), 800);
+          }
+        } catch (err) {
+          saveBtn.textContent = 'err';
+          saveBtn.title = String(err);
+        } finally {
+          saveBtn.disabled = false;
+        }
+      });
+      saveTd.append(saveBtn);
+      tr.append(saveTd);
+
+      tbody.append(tr);
+    }
+    table.append(tbody);
+    wrap.append(table);
+    root.append(wrap);
+  }
+
   // Derived question state — cold-loaded from /api/state, then mutated
   // live by `question_added` / `question_resolved` dashboard events.
   const QUESTION_HISTORY_LIMIT = 20;
@@ -3387,6 +3514,9 @@ window.marked = marked;
     // Schedules pane has no SSE channel for mutations, so re-fetch
     // on activation so the operator never lands on stale data.
     if (target === 'schedules') refreshSchedules();
+    // Capabilities table is on the system pane; fetch on each activation
+    // so it stays fresh without an SSE channel.
+    if (target === 'system') fetchAndRenderCapabilities();
   }
   function syncTabFromHash() {
     const h = (window.location.hash || '#swarm').replace(/^#/, '');