jobq-graph: re-add per-node cancel button

Fixes #3067.

<hive-jobq-graph> gains a `cancellable` attribute: any non-terminal
node (Pending/Running/Finishing) gets a small cancel button, and a
click dispatches `hive-jobq-graph-cancel` (`detail: { id }`) rather
than POSTing anything itself -- which endpoint actually cancels a
node is the host's domain concept, same "push data out, host decides"
shape `hive-jobq-graph-update` already uses.

builds.js turns it on for R3BU1LD QU3U3, confirms via themedConfirm,
then POSTs the existing `/api/rebuild-queue/{id}/cancel` endpoint.
No manual refresh needed -- cancelling flips node state, which
already fires rebuild_queue_changed over SSE, and the page's existing
handler for that tick already calls jobqGraphEl.refresh().

Also removed ~130 lines of dead `.rqe-*` CSS in system-sections.css
left over from the bespoke pre-<hive-jobq-graph> queue renderer
(confirmed zero JS references before deleting each rule; kept the
still-used `.rqe-kind`/`.rqe-agent`/`.rqe-source*`).

docs/web-ui/dashboard.md's R3BU1LD QU3U3 section updated to match
current behaviour (cancel button, waits-on text instead of the old
"no per-node actions" note, sibling order no longer implies anything
since deps render as text not a reordered rail).

docs/web-ui/dashboard.md

@@ -232,21 +232,28 @@ dashboard pages treat the tick as a pure refetch trigger).
 
 Each row is one root graph node (`parent: null`); a multi-step op's
 per-agent subgraphs and sub-steps render as nodes within that one
-entry (structural `parent` edges define the tree, `deps` edges order
-siblings). A row shows a state glyph (`⏸` pending / `▶` running /
-`◐` finishing — own work done, a sub-node still running / `✔` done /
-`✖` failed / `⊘` cancelled / `·` skipped) and each step's own
-label/agent. **No source chip, kind label, cancel button, timing, or
-build-log deep-link on rows** — the generic component has no
-per-node action affordances or entry-level metadata (no equivalent of
-the old `DagView`'s `source`/`reason`/`created_at`, which were
-`NodeKind::Dag`-specific fields the generic wire doesn't carry); per
-mara's steer on hyperhive#2812 ("dont feel constrained by what the ui
-does currently"), the first cut presents what the endpoint actually
-gives rather than reconstructing the old per-row chrome. Settled
-entries render their **full step tree**, not just a bare summary —
-unlike the old `DagView` projection, this wire does not filter `Done`
-nodes out.
+entry (structural `parent` edges define the tree; sibling order is
+array order, unchanged from the wire). A row shows a state glyph (`⏸`
+pending / `▶` running / `◐` finishing — own work done, a sub-node
+still running / `✔` done / `✖` failed / `⊘` cancelled / `·` skipped)
+and each step's own label/agent. A `Node`-kind dep on a sibling shows
+as a plain "waits on: `<label>`" text line under the row — an earlier
+gutter-rail version was reverted (it broke visually whenever a nested
+subtree sat between the two related rows; text has no such gap).
+`builds.js` mounts the element with `cancellable` set, which turns on
+a per-node cancel button (`✕`) on any non-terminal row — the button
+dispatches `hive-jobq-graph-cancel`, and the page does the actual
+`POST /api/rebuild-queue/{id}/cancel`, matching the wire event as its
+own domain concept (the component knows nothing about that endpoint).
+**Still no source chip, kind label, timing, or build-log deep-link on
+rows** — no equivalent of the old `DagView`'s `source`/`reason`/
+`created_at`, which were `NodeKind::Dag`-specific fields the generic
+wire doesn't carry; per mara's original steer ("dont feel constrained
+by what the ui does currently"), rows present what the endpoint
+actually gives rather than reconstructing the old per-row chrome.
+Settled entries render their **full step tree**, not just a bare
+summary — unlike the old `DagView` projection, this wire does not
+filter `Done` nodes out.
 
 Below the queue, a **live build-log panel** (`#rebuild-live-log`,
 `renderRebuildLiveLog`) shows the currently-running rebuild's output