chore(#1055): address argus review nits

- rename cap-cap-col → cap-col; add CSS rules for .cap-col and .cap-save-col
- drop zero-width-space replace in capability header cells (nowrap makes it a no-op)
- add Capability::ALL to hive-sh4re; validate incoming cap strings in post_capabilities

frontend/packages/dashboard/src/dashboard.css

@@ -2077,6 +2077,12 @@ body.logs-shell {
   text-align: left !important;
   min-width: 8em;
 }
+.cap-col {
+  min-width: 5em;
+}
+.cap-save-col {
+  min-width: 4em;
+}
 .cap-agent-name {
   color: var(--fg);
   font-weight: 600;

frontend/packages/dashboard/src/tabs.js

@@ -1221,7 +1221,7 @@ window.marked = marked;
     const hrow = el('tr');
     hrow.append(el('th', { class: 'cap-agent-col' }, 'agent'));
     for (const c of caps) {
-      hrow.append(el('th', { class: 'cap-cap-col', title: c }, c.replace(/_/g, '_​')));
+      hrow.append(el('th', { class: 'cap-col', title: c }, c));
     }
     hrow.append(el('th', { class: 'cap-save-col' }, ''));
     thead.append(hrow);
@@ -1240,7 +1240,7 @@ window.marked = marked;
       const checkboxes = [];
       for (const c of caps) {
         const checked = assigned.includes(c);
-        const td = el('td', { class: 'cap-cap-col' });
+        const td = el('td', { class: 'cap-col' });
         const cb = el('input', {
           type: 'checkbox',
           class: 'cap-cb',

hive-c0re/src/dashboard.rs

@@ -2595,6 +2595,12 @@ async fn post_capabilities(
     if let Some(reject) = guard_agent_name(&state, &logical).await {
         return reject;
     }
+    let known: Vec<&str> = hive_sh4re::Capability::ALL.iter().map(|c| c.as_str()).collect();
+    for cap in &body.caps {
+        if !known.contains(&cap.as_str()) {
+            return error_response(&format!("unknown capability: {cap}"));
+        }
+    }
     if let Err(e) = crate::capabilities::set_caps(&logical, &body.caps) {
         return error_response(&format!("set capabilities for {logical}: {e}"));
     }

hive-sh4re/src/lib.rs

@@ -923,6 +923,14 @@ pub enum Capability {
 }
 
 impl Capability {
+    /// Every known capability in a stable order. Use this to enumerate
+    /// columns in the permissions UI or validate incoming capability strings.
+    pub const ALL: &'static [Self] = &[
+        Self::ManageRootAgent,
+        Self::ReadHostJournal,
+        Self::QueryAgentState,
+    ];
+
     /// Canonical `snake_case` name for this capability (matches serde).
     #[must_use]
     pub fn as_str(self) -> &'static str {