flow.js: subscribe to /dashboard/stream with ?kinds= filter (closes #408)

Frontend half of #408 — wires flow.js's terminal subscribe URL to
the kinds-filter damocles shipped in #499. Only the four kinds
flow.js actually handles get sent on the wire:

- sent / delivered → broker terminal renderer
- container_state_changed / container_removed → local autocomplete
  cache (flowContainers Map used by the @-mention composer)

Everything else (approval_*, question_*, transient_*, tombstones_*,
meta_*, rebuild_queue_*) is now dropped server-side before the
JSON-serialise, instead of being deserialised + dispatched to
flow.js's no-op `_default: () => {}` per frame.

Tabs.js keeps the unfiltered `/dashboard/stream` subscribe since
it routes every mutation kind into its derived stores.

## SharedWorker note

`openStream` keys subscriptions by full URL (#448, #453). The
filtered URL is therefore its own upstream connection to
hive-c0re — when both /index.html and /flow.html are open at the
same time the worker holds two upstreams (one filtered, one full)
instead of today's single shared upstream. The trade is small
per-frame wire-byte + serialise savings vs +1 backend connection
in the both-open case. The flow-page-only case is a pure win.
Acceptable per #408's intent ("split flow messages from main
endpoint").

Round-trip note: if the backend's `kind_tag` strings ever drift
from what's listed here, the affected kind silently never matches
and flow loses that event class. damocles's #499 added a serde
round-trip test against `kind_tag` to guard the backend side;
the frontend mirrors the spelling exactly from the PR body.

frontend/packages/dashboard/src/flow.js

@@ -187,10 +187,20 @@ import {
       logEl: flow,
       pillAnchor: flowMain,
       historyUrl: '/dashboard/history',
-      streamUrl: '/dashboard/stream',
+      // #408: server-side filter — only the kinds this page actually
+      // renders or routes (sent/delivered → broker terminal,
+      // container_state_changed/_removed → local autocomplete cache).
+      // Backend (#499) pre-parses the allow-list at subscribe time so
+      // the per-frame hot path is one HashSet::contains and the
+      // JSON-serialise is skipped entirely on irrelevant kinds. The
+      // dashboard tabs page (tabs.js) keeps the unfiltered subscribe
+      // since it routes every mutation kind into its derived stores.
+      streamUrl: '/dashboard/stream?kinds=sent,delivered,container_state_changed,container_removed',
       // #448: route through the SharedWorker so this page's SSE shares
       // a single backend connection with /index.html (and any other
-      // open hyperhive tab).
+      // open hyperhive tab). Worker keys on the full URL (incl.
+      // query string), so the filtered subscribe is its own upstream
+      // — won't accidentally share with tabs.js's wider subscribe.
       streamFactory: openStream,
       renderers: {
         sent:      (ev, api) => renderMsg(ev, api, '→'),