feat(#1005): capabilities UI — per-agent tool-group table in SYST3M tab

Backend (hive-c0re/src/dashboard.rs):
  GET /api/tool-groups  — returns { groups: [...], assignments: {...} };
    groups list comes from ToolGroup::ALL so the UI needs no change when
    a new group is added (satisfies the 'no extend ui' requirement)
  POST /api/tool-groups/{agent} — accepts { groups: [...] }, calls
    set_groups() then enqueues a rebuild so the new HIVE_TOOL_GROUPS
    env var takes effect immediately

hive-sh4re/src/lib.rs:
  Added ToolGroup::ALL const (ordered slice of every group)
  Added ToolGroup::as_str() — snake_case wire name, matches serde

Frontend:
  SYST3M tab: new C4P4B1L1T13S section above K3PT ST4T3 with
    #capabilities-section placeholder
  tabs.js: fetchAndRenderCapabilities() + renderCapabilities() —
    columns are built from the groups array returned by the API;
    each row has one checkbox per group and a save button that POSTs
    and re-fetches after 800ms; agents without explicit assignments
    show a (default) label; triggered on each SYST3M tab activation
  dashboard.css: .cap-table-wrap/.cap-table/.cap-row/.cap-agent-*
    styles for the scrollable matrix table

hive-sh4re/src/lib.rs

@@ -789,6 +789,36 @@ impl ToolGroup {
         Self::Diagnostics,
         Self::Execution,
     ];
+
+    /// Every known tool group in a stable order. Use this to enumerate
+    /// columns in the capabilities UI or any other place that needs the
+    /// full list without hard-coding it at the call site.
+    pub const ALL: &'static [Self] = &[
+        Self::Messaging,
+        Self::Meta,
+        Self::Inbox,
+        Self::Lifecycle,
+        Self::Approvals,
+        Self::Scheduling,
+        Self::Diagnostics,
+        Self::Execution,
+    ];
+
+    /// The snake_case wire name for this group (matches `serde(rename_all =
+    /// "snake_case")` serialisation).
+    #[must_use]
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Messaging => "messaging",
+            Self::Meta => "meta",
+            Self::Inbox => "inbox",
+            Self::Lifecycle => "lifecycle",
+            Self::Approvals => "approvals",
+            Self::Scheduling => "scheduling",
+            Self::Diagnostics => "diagnostics",
+            Self::Execution => "execution",
+        }
+    }
 }
 
 /// Schedule row shape on the wire — mirror of