dashboard: rename src/app.js → src/tabs.js (closes #406)

#406 was the JS-split refactor: pull shared helpers into
common.js (step 1), pull the flow-only IIFEs into flow.js
(step 2), then rename the legacy combined entry from app.js
to tabs.js (step 3 — this commit) to reflect that the bundle
now owns the dashboard tabs surface only.

What moved:
- `frontend/packages/dashboard/src/app.js` → `tabs.js`
- `build.mjs` entry: `src('app.js')` → `src('tabs.js')`;
  output is now `static/tabs.js`
- `index.html` `<script>` src: `/static/app.js` →
  `/static/tabs.js`; the FL0W-section comment retouched
- `flow.html` reference from `/static/app.js`-as-tabs to
  `/static/tabs.js`; notif + offscreen-inbox comments rewired
  to point at the correct owners (common.js for NOTIF,
  flow.js for renderInbox)
- `common.js`, `flow.js`, `tabs.js` headers: scrub stale
  "app.js" references; document that #406 steps 2 + 3 are
  done and both pages import directly from common.js
- `dashboard.css` comments: every "by app.js" → "by tabs.js"
- `docs/web-ui.md`, `docs/conventions.md`: legacy
  `assets/app.js` → `assets/tabs.js` (the path prefix is
  itself stale from a much-earlier rename, but consistent
  with the rest of those docs)
- `CLAUDE.md` file map: refresh the dashboard package's
  src/ and dist/ layouts to reflect the post-split shape
  (tabs.js, flow.js, common.js, stream-worker.js)

What did NOT move:
- `frontend/packages/agent/src/app.js` (per-agent UI entry)
  stays named `app.js` — it's a separate package, has only
  one entry point, no split happened there
- The two "no-op when target absent" guards in renderContainers
  and renderQuestions are kept as belt-and-suspenders for any
  future page that adds tabs.js without the corresponding
  sections; comments updated to note this rather than the
  pre-split flow.html reason

Functional behaviour identical; this is a pure rename + comment
sweep.

frontend/packages/dashboard/src/common.js

@@ -1,14 +1,13 @@
-// Shared dashboard helpers — extracted from app.js as step 1 of the
-// #406 split. These bits are used by both the tab dashboard
-// (index.html) and the flow page (flow.html): pure DOM helpers, the
-// side-panel singleton, the OS-notification module, and the
-// path-link / file-preview infrastructure for the side panel.
+// Shared dashboard helpers — extracted from the original monolithic
+// dashboard JS as step 1 of the #406 split. These bits are used by
+// both the tab dashboard (index.html) and the flow page (flow.html):
+// pure DOM helpers, the side-panel singleton, the OS-notification
+// module, and the path-link / file-preview infrastructure for the
+// side panel.
 //
-// Both pages currently still load `app.js` as their single entry
-// point; this module is bundled inline by esbuild via the import
-// below. The follow-up step splits app.js into per-page entry
-// points (tabs.js + flow.js), at which point both will import from
-// here directly.
+// Each page now has its own entry point — `./tabs.js` for index.html,
+// `./flow.js` for flow.html — and both import from here directly
+// (#406 steps 2 + 3 complete; #406 closed).
 
 import { linkify as termLinkify } from '@hive/shared/terminal.js';
 
@@ -53,7 +52,7 @@ export const form = (action, btnClass, btnLabel, confirmMsg, extra = {}, opts =
   return f;
 };
 
-// `truncate`, `fmtAgo`, `fmtElapsed`, `fmtDuration` stay in app.js
+// `truncate`, `fmtAgo`, `fmtElapsed`, `fmtDuration` stay in tabs.js
 // for now — each has display-specific phrasing ("X running", "X ago")
 // tied to its caller, so they don't generalise cleanly. We can lift
 // them when a second consumer needs the same shape.
@@ -62,7 +61,7 @@ export const form = (action, btnClass, btnLabel, confirmMsg, extra = {}, opts =
 // Returns an EventSource-shaped object backed by a SharedWorker that
 // holds ONE upstream `new EventSource(url)` and fans events out to
 // every connected tab. Replaces direct `new EventSource(url)` at the
-// dashboard's two consumer sites (app.js inline + flow.js via
+// dashboard's two consumer sites (tabs.js inline + flow.js via
 // terminal.js's `streamFactory` option) so N hyperhive tabs share
 // ONE backend connection — way under the browser's per-host
 // connection cap, immune to per-tab throttling that drops the SSE