feat(#1005): capabilities UI — per-agent tool-group table in SYST3M tab

Backend (hive-c0re/src/dashboard.rs):
  GET /api/tool-groups  — returns { groups: [...], assignments: {...} };
    groups list comes from ToolGroup::ALL so the UI needs no change when
    a new group is added (satisfies the 'no extend ui' requirement)
  POST /api/tool-groups/{agent} — accepts { groups: [...] }, calls
    set_groups() then enqueues a rebuild so the new HIVE_TOOL_GROUPS
    env var takes effect immediately

hive-sh4re/src/lib.rs:
  Added ToolGroup::ALL const (ordered slice of every group)
  Added ToolGroup::as_str() — snake_case wire name, matches serde

Frontend:
  SYST3M tab: new C4P4B1L1T13S section above K3PT ST4T3 with
    #capabilities-section placeholder
  tabs.js: fetchAndRenderCapabilities() + renderCapabilities() —
    columns are built from the groups array returned by the API;
    each row has one checkbox per group and a save button that POSTs
    and re-fetches after 800ms; agents without explicit assignments
    show a (default) label; triggered on each SYST3M tab activation
  dashboard.css: .cap-table-wrap/.cap-table/.cap-row/.cap-agent-*
    styles for the scrollable matrix table

frontend/packages/dashboard/src/index.html

@@ -171,6 +171,18 @@
       <div id="tombstones-section">
         <p class="meta">loading…</p>
       </div>
+
+      <!-- C4P4B1L1T13S: per-agent tool-group matrix. Rows = agents,
+           cols = tool groups fetched from GET /api/tool-groups.
+           Checking / unchecking and saving POSTs to
+           /api/tool-groups/{agent}; a rebuild is queued automatically.
+           Absent agents default to the role default (shown in parens). -->
+      <h2>◆ C4P4B1L1T13S ◆</h2>
+      <div class="divider">══════════════════════════════════════════════════════════════</div>
+      <p class="meta">per-agent tool-group assignments. columns are filled from the backend — adding a new group requires no UI change. agents without an explicit entry use the role default (agents: messaging, meta, inbox, execution; manager: all). saving queues a rebuild.</p>
+      <div id="capabilities-section">
+        <p class="meta">loading…</p>
+      </div>
     </section>
 
     <!-- P33RS: peer hive link cards. Rendered from state.peer_hives;