dashboard: rename src/app.js → src/tabs.js (closes #406)

#406 was the JS-split refactor: pull shared helpers into
common.js (step 1), pull the flow-only IIFEs into flow.js
(step 2), then rename the legacy combined entry from app.js
to tabs.js (step 3 — this commit) to reflect that the bundle
now owns the dashboard tabs surface only.

What moved:
- `frontend/packages/dashboard/src/app.js` → `tabs.js`
- `build.mjs` entry: `src('app.js')` → `src('tabs.js')`;
  output is now `static/tabs.js`
- `index.html` `<script>` src: `/static/app.js` →
  `/static/tabs.js`; the FL0W-section comment retouched
- `flow.html` reference from `/static/app.js`-as-tabs to
  `/static/tabs.js`; notif + offscreen-inbox comments rewired
  to point at the correct owners (common.js for NOTIF,
  flow.js for renderInbox)
- `common.js`, `flow.js`, `tabs.js` headers: scrub stale
  "app.js" references; document that #406 steps 2 + 3 are
  done and both pages import directly from common.js
- `dashboard.css` comments: every "by app.js" → "by tabs.js"
- `docs/web-ui.md`, `docs/conventions.md`: legacy
  `assets/app.js` → `assets/tabs.js` (the path prefix is
  itself stale from a much-earlier rename, but consistent
  with the rest of those docs)
- `CLAUDE.md` file map: refresh the dashboard package's
  src/ and dist/ layouts to reflect the post-split shape
  (tabs.js, flow.js, common.js, stream-worker.js)

What did NOT move:
- `frontend/packages/agent/src/app.js` (per-agent UI entry)
  stays named `app.js` — it's a separate package, has only
  one entry point, no split happened there
- The two "no-op when target absent" guards in renderContainers
  and renderQuestions are kept as belt-and-suspenders for any
  future page that adds tabs.js without the corresponding
  sections; comments updated to note this rather than the
  pre-split flow.html reason

Functional behaviour identical; this is a pure rename + comment
sweep.

frontend/packages/dashboard/build.mjs

@@ -2,11 +2,11 @@
 //
 //   dist/index.html               served by the Rust router at GET /
 //   dist/flow.html                served at GET /flow.html
-//   dist/static/app.js            /index.html entry — tab renderers +
+//   dist/static/tabs.js           /index.html entry — tab renderers +
 //                                  tab routing + refreshState
 //   dist/static/flow.js           /flow.html entry — broker terminal +
 //                                  operator inbox + @-mention composer
-//   dist/static/{app,flow}.js.map source map siblings
+//   dist/static/{tabs,flow}.js.map source map siblings
 //   dist/static/dashboard.css     served at /static/dashboard.css
 //                                  (@import resolved from @hive/shared)
 //
@@ -35,7 +35,7 @@ mkdirSync(staticDir(''), { recursive: true });
 // follow-up once asset sizes warrant it). esbuild writes each entry
 // to `static/<name>.js` based on the entryPoint basename.
 await build({
-  entryPoints: [src('app.js'), src('flow.js')],
+  entryPoints: [src('tabs.js'), src('flow.js')],
   outdir: staticDir(''),
   bundle: true,
   format: 'esm',
@@ -47,7 +47,7 @@ await build({
 
 // Stream-worker entry (#448). Lives in a separate bundle: SharedWorker
 // scripts run in a different global (`self` is the worker scope, no
-// `window`) so they can't be inlined into app.js / flow.js. Output is
+// `window`) so they can't be inlined into tabs.js / flow.js. Output is
 // at `static/stream-worker.js`; common.js's `openStream` references
 // `/static/stream-worker.js` as the SharedWorker URL. `format: 'iife'`
 // matches the classic-script load (`new SharedWorker(url, name)` with