refactor(frontend): move S3TT1NGS to its own /settings.html page (#1464 step 2)

Extracts the operator-local preferences (browser-notification toggle)
out of the dashboard tab strip into a standalone /settings.html page,
reached from the H0M3 hub — same minimal-chrome pattern as /flow.html
and /logs.html. The dashboard tab strip is now purely operational.

- new settings.{html,css,js}; settings.js binds NOTIF + renders the
  shared server-warnings banner (matching the other standalone pages).
- drop the S3TT1NGS tab + pane from dashboard.html; the NOTIF.bind()
  toggle wiring moves to settings.js. The dashboard keeps NOTIF.show()
  (approvals / questions) — it reads the same browser permission +
  localStorage mute flag the settings page sets, so firing still works.
- move .notif-row / .btn-notif from dashboard.css to settings.css.
- add a Settings tile to the H0M3 hub; wire the new entries into
  build.mjs and update the nix/frontend.nix asset manifest comment.

First slice of #1464 step 2; the ST4TS page extraction follows separately.

frontend/packages/dashboard/src/tabs.js

@@ -3979,7 +3979,10 @@ window.marked = marked;
   // title reflect unread agent→operator messages immediately, before the
   // operator opens the tab. Live updates arrive via the broker stream.
   refreshOperatorInbox();
-  NOTIF.bind();
+  // NOTIF.bind() (the enable/mute/unmute toggle UI) moved to /settings.html
+  // with the S3TT1NGS page. The dashboard keeps NOTIF.show() for approval/
+  // question notifications — it reads the browser permission + localStorage
+  // mute flag the settings page sets, so no bind() is needed here.
   Panel.bind();
 
   // ─── live updates: dashboard event stream ──────────────────────────────
@@ -4053,9 +4056,10 @@ window.marked = marked;
 
   // ─── tab routing ───────────────────────────────────────────────────────
   // Hash-based: `#swarm` / `#call` / `#system` / `#schedules` /
-  // `#settings` activate the matching pane on the dashboard. Empty
-  // hash defaults to SW4RM. FL0W is NOT a tab — it's a separate page
-  // (`/flow.html`) reached via the tab-strip link. Tab routing only
+  // `#permissions` / `#stats` activate the matching pane on the
+  // dashboard. Empty hash defaults to SW4RM. FL0W and S3TT1NGS are NOT
+  // tabs — they're separate pages (`/flow.html`, `/settings.html`)
+  // reached from the H0M3 hub. Tab routing only
   // applies when the tab DOM is present (e.g. not on the flow page
   // itself, where these elements don't exist and the loop no-ops).
   // The shared hash-routed tab strip (@hive/shared/tabs.js) owns the