feat(#1005): capabilities UI — per-agent tool-group table in SYST3M tab

Backend (hive-c0re/src/dashboard.rs):
  GET /api/tool-groups  — returns { groups: [...], assignments: {...} };
    groups list comes from ToolGroup::ALL so the UI needs no change when
    a new group is added (satisfies the 'no extend ui' requirement)
  POST /api/tool-groups/{agent} — accepts { groups: [...] }, calls
    set_groups() then enqueues a rebuild so the new HIVE_TOOL_GROUPS
    env var takes effect immediately

hive-sh4re/src/lib.rs:
  Added ToolGroup::ALL const (ordered slice of every group)
  Added ToolGroup::as_str() — snake_case wire name, matches serde

Frontend:
  SYST3M tab: new C4P4B1L1T13S section above K3PT ST4T3 with
    #capabilities-section placeholder
  tabs.js: fetchAndRenderCapabilities() + renderCapabilities() —
    columns are built from the groups array returned by the API;
    each row has one checkbox per group and a save button that POSTs
    and re-fetches after 800ms; agents without explicit assignments
    show a (default) label; triggered on each SYST3M tab activation
  dashboard.css: .cap-table-wrap/.cap-table/.cap-row/.cap-agent-*
    styles for the scrollable matrix table

frontend/packages/dashboard/src/dashboard.css

@@ -2045,6 +2045,58 @@ body.logs-shell {
   font-size: 0.85em;
 }
 
+/* ─── capabilities (tool-group) table ──────────────────────────────
+   Agents × tool-groups matrix in the SYST3M tab. Horizontally
+   scrollable on narrow viewports. */
+.cap-table-wrap {
+  overflow-x: auto;
+  margin-top: 0.5em;
+}
+.cap-table {
+  border-collapse: collapse;
+  font-size: 0.82em;
+  min-width: 100%;
+}
+.cap-table th,
+.cap-table td {
+  padding: 0.35em 0.6em;
+  border: 1px solid var(--border);
+  text-align: center;
+  vertical-align: middle;
+}
+.cap-table thead th {
+  background: var(--bg-elev);
+  color: var(--muted);
+  letter-spacing: 0.05em;
+  white-space: nowrap;
+}
+.cap-agent-col {
+  text-align: left !important;
+  min-width: 8em;
+}
+.cap-agent-name {
+  color: var(--fg);
+  font-weight: 600;
+}
+.cap-default-label {
+  margin-left: 0.4em;
+  font-size: 0.85em;
+}
+.cap-cb {
+  cursor: pointer;
+  width: 1em;
+  height: 1em;
+  accent-color: var(--purple);
+}
+.cap-save-btn {
+  font-size: 0.78em;
+  padding: 0.2em 0.6em;
+  white-space: nowrap;
+}
+.cap-row:hover td {
+  background: var(--bg-elev);
+}
+
 /* ─── scheduled prompts tab ────────────────────────────────────────
    Creation form at the top, list of queued schedule cards below.
    Cards show: id + source + due-in + cancel-all in the header,