dashboard: rename src/app.js → src/tabs.js (closes #406)

#406 was the JS-split refactor: pull shared helpers into
common.js (step 1), pull the flow-only IIFEs into flow.js
(step 2), then rename the legacy combined entry from app.js
to tabs.js (step 3 — this commit) to reflect that the bundle
now owns the dashboard tabs surface only.

What moved:
- `frontend/packages/dashboard/src/app.js` → `tabs.js`
- `build.mjs` entry: `src('app.js')` → `src('tabs.js')`;
  output is now `static/tabs.js`
- `index.html` `<script>` src: `/static/app.js` →
  `/static/tabs.js`; the FL0W-section comment retouched
- `flow.html` reference from `/static/app.js`-as-tabs to
  `/static/tabs.js`; notif + offscreen-inbox comments rewired
  to point at the correct owners (common.js for NOTIF,
  flow.js for renderInbox)
- `common.js`, `flow.js`, `tabs.js` headers: scrub stale
  "app.js" references; document that #406 steps 2 + 3 are
  done and both pages import directly from common.js
- `dashboard.css` comments: every "by app.js" → "by tabs.js"
- `docs/web-ui.md`, `docs/conventions.md`: legacy
  `assets/app.js` → `assets/tabs.js` (the path prefix is
  itself stale from a much-earlier rename, but consistent
  with the rest of those docs)
- `CLAUDE.md` file map: refresh the dashboard package's
  src/ and dist/ layouts to reflect the post-split shape
  (tabs.js, flow.js, common.js, stream-worker.js)

What did NOT move:
- `frontend/packages/agent/src/app.js` (per-agent UI entry)
  stays named `app.js` — it's a separate package, has only
  one entry point, no split happened there
- The two "no-op when target absent" guards in renderContainers
  and renderQuestions are kept as belt-and-suspenders for any
  future page that adds tabs.js without the corresponding
  sections; comments updated to note this rather than the
  pre-split flow.html reason

Functional behaviour identical; this is a pure rename + comment
sweep.

docs/conventions.md

@@ -34,7 +34,7 @@ in `hive-c0re::dashboard_events::DashboardEvent`.
 ## Async forms
 
 Dashboard + per-agent mutating forms carry `data-async`; a delegated
-`submit` listener in `assets/app.js` intercepts, shows a spinner,
+`submit` listener in `assets/tabs.js` intercepts, shows a spinner,
 POSTs `application/x-www-form-urlencoded` (axum's `Form` extractor
 rejects multipart), calls `refreshState()` on success. New mutating
 forms should add `data-async` and optionally `data-confirm` (for a

docs/web-ui.md

@@ -67,7 +67,7 @@ listener: read `data-confirm`, swap the button to a spinner, POST
 re-render), call `refreshState()`. State shapes live in
 `dashboard.rs::StateSnapshot` and `web_ui.rs::StateSnapshot` — when
 adding state fields, plumb through the snapshot struct and the
-relevant `assets/app.js` render function.
+relevant `assets/tabs.js` render function.
 
 **Focus preservation:** `refreshState` checks whether
 `document.activeElement` sits inside one of the managed sections
@@ -298,7 +298,7 @@ the tooltip says "select … for bulk actions" or "deselect … (or press
 Esc to clear all)". The `<img>` points at `<url>/icon`; load failure
 falls back to the dimmed hyperhive mark (`/favicon.svg`). The card
 body sits to the right with three stacked lines
-(`assets/app.js::renderContainers`).
+(`assets/tabs.js::renderContainers`).
 
 - Line 1: agent name (link → new tab), m1nd/ag3nt chip, an
   **icon-only nav strip** populated async from the agent backend
@@ -382,7 +382,7 @@ every render before the bar appears.
 
 ### Approval card
 
-Each pending approval renders as a card (`assets/app.js::
+Each pending approval renders as a card (`assets/tabs.js::
 renderApprovals`) with three stacked sections:
 
 - **identity header** — glyph, `#id`, agent, kind chip, (for