dashboard: rename src/app.js → src/tabs.js (closes #406)

#406 was the JS-split refactor: pull shared helpers into
common.js (step 1), pull the flow-only IIFEs into flow.js
(step 2), then rename the legacy combined entry from app.js
to tabs.js (step 3 — this commit) to reflect that the bundle
now owns the dashboard tabs surface only.

What moved:
- `frontend/packages/dashboard/src/app.js` → `tabs.js`
- `build.mjs` entry: `src('app.js')` → `src('tabs.js')`;
  output is now `static/tabs.js`
- `index.html` `<script>` src: `/static/app.js` →
  `/static/tabs.js`; the FL0W-section comment retouched
- `flow.html` reference from `/static/app.js`-as-tabs to
  `/static/tabs.js`; notif + offscreen-inbox comments rewired
  to point at the correct owners (common.js for NOTIF,
  flow.js for renderInbox)
- `common.js`, `flow.js`, `tabs.js` headers: scrub stale
  "app.js" references; document that #406 steps 2 + 3 are
  done and both pages import directly from common.js
- `dashboard.css` comments: every "by app.js" → "by tabs.js"
- `docs/web-ui.md`, `docs/conventions.md`: legacy
  `assets/app.js` → `assets/tabs.js` (the path prefix is
  itself stale from a much-earlier rename, but consistent
  with the rest of those docs)
- `CLAUDE.md` file map: refresh the dashboard package's
  src/ and dist/ layouts to reflect the post-split shape
  (tabs.js, flow.js, common.js, stream-worker.js)

What did NOT move:
- `frontend/packages/agent/src/app.js` (per-agent UI entry)
  stays named `app.js` — it's a separate package, has only
  one entry point, no split happened there
- The two "no-op when target absent" guards in renderContainers
  and renderQuestions are kept as belt-and-suspenders for any
  future page that adds tabs.js without the corresponding
  sections; comments updated to note this rather than the
  pre-split flow.html reason

Functional behaviour identical; this is a pure rename + comment
sweep.

frontend/packages/dashboard/src/dashboard.css

@@ -108,7 +108,7 @@ body.dashboard-shell {
 }
 
 /* Tab pane visibility — show only the active one. The .tab-pane-active
-   class is set by app.js based on the URL hash; default (no hash)
+   class is set by tabs.js based on the URL hash; default (no hash)
    resolves to SW4RM. */
 .tab-pane { display: none; }
 .tab-pane.tab-pane-active { display: block; }
@@ -190,7 +190,7 @@ a:hover {
   transition: opacity 200ms ease, border-color 200ms ease;
 }
 /* Topology indent (#363). Each depth level shifts the row right by one
-   step; the .tree-prefix span (drawn by app.js::treePrefix) carries
+   step; the .tree-prefix span (drawn by tabs.js::treePrefix) carries
    the ├─ / └─ glyph and any continuation lines that thread through
    ancestor columns. When every container has parent=null (pre-#361
    state) `[data-depth]` is absent on every row and these rules are
@@ -1592,7 +1592,7 @@ body.flow-shell .tabbar .tab.active.tab-link {
 }
 /* Tail pill (↓ N new): bottom offset clears the floating composer.
    z-index escapes the stacking context the .terminal-wrap's
-   backdrop-filter creates (issue #375) — app.js anchors the pill
+   backdrop-filter creates (issue #375) — tabs.js anchors the pill
    on .flow-main now (not .terminal-wrap), so this z-index reaches
    the root stacking context and properly floats above the
    composer at z-index 30. */
@@ -1861,6 +1861,6 @@ body.flow-shell .tabbar .tab.active.tab-link {
 /* Pad the dashboard body so the sticky bar doesn't cover the
    bottom of the agent list. ~3.4em covers the bar's vertical
    footprint with breathing room; only applies when the bar is
-   visible (`body.has-selection`, toggled by app.js when the
+   visible (`body.has-selection`, toggled by tabs.js when the
    selection set is non-empty). */
 body.dashboard-shell.has-selection { padding-bottom: 4.5em; }