docs: fix genuine passive-voice hits in docs/web-ui (small files)

agent.md, css-vars.md, design-guide.md, shape.md, terminal-rendering.md --
26 of 40 write-good.Passive hits rewritten to name the actor (hive-agent,
browsers, the harness, the client, lifecycle::{spawn,rebuild}, CSS, the
router, ...), reusing an actor already named nearby wherever one exists.
14 left alone: established config-state conditionals ("when X is
set/enabled/given/called"), negative-capability/state-descriptor idioms
("is gone", "is hidden", "is unchanged"), one false-positive
("typed slash commands" as a compound noun, not a passive action), a
backward-looking changelog fact with no actor worth naming, and two
deliberately-parallel rhetorical contrasts (sanitized vs XSS-safe;
cache-hit vs cache-miss) left symmetric on purpose.

dashboard.md (70 more hits) is the next docs/web-ui/ batch, not part of
this one -- big enough to deserve its own PR.

docs/web-ui/shape.md

@@ -8,8 +8,8 @@
 - `GET /` → `index.html` from the bundled frontend dist (see
   `frontend/`). Both binaries' routers declare their dynamic
   endpoints first and then `fallback_service(ServeDir::new(...))`
-  pointed at `HIVE_STATIC_DIR` — anything not matched by an API or
-  action route is served from the dist. Dashboard dist lives at
+  pointed at `HIVE_STATIC_DIR` — that fallback serves anything not
+  matched by an API or action route from the dist. Dashboard dist lives at
   `${frontend}/dashboard`; per-agent dist is the merged
   `hyperhive.frontend.mergedDist` (default agent dist + per-agent
   `extraFiles` overlay).
@@ -43,7 +43,7 @@
   to `target="_blank"`.
 - `GET /api/state` → JSON snapshot the JS app renders into the
   DOM. Includes a top-level `seq` (the dashboard event channel's
-  high-water mark at the moment the snapshot was assembled);
+  high-water mark at the moment the server assembled the snapshot);
   clients use it to dedupe their buffered SSE traffic against
   the snapshot (drop frames with `seq <= snapshot.seq`).
 - `GET /api/dashboard/stream` (dashboard) / `GET /events/stream`
@@ -88,9 +88,9 @@
 
 ## Shared terminal pane
 
-Both surfaces' scrollable log streams (`#msgflow` on the dashboard,
-`#live` on the per-agent page) are backed by the shared terminal
-factory in `@hive/shared/terminal.js`. The factory wires up
+The shared terminal factory in `@hive/shared/terminal.js` backs both
+surfaces' scrollable log streams (`#msgflow` on the dashboard, `#live`
+on the per-agent page). The factory wires up
 sticky-bottom autoscroll, a "↓ N new" pill, history backfill, and
 SSE replay. Pages register a `kind → renderer` map; unknown kinds
 fall through to a JSON-dump note row. The factory ships three row
@@ -175,8 +175,8 @@ initial visual lag to one frame instead of one microtask + frame.
 
 **Backfill + SSE.** Cold load fetches `historyUrl` (replay), then
 subscribes to `streamUrl` (live tail). Both endpoints return
-`{ seq, events }` so the client can dedupe — events with
-`seq <= snapshot.seq` from the SSE stream are dropped silently
+`{ seq, events }` so the client can dedupe — the client silently
+drops events with `seq <= snapshot.seq` from the SSE stream
 (the snapshot already covers them). History rows render with a
 `.no-anim` class so they don't stagger in like live events. The
 optional `streamFactory(url)` callback lets the dashboard hand
@@ -221,8 +221,8 @@ leave it empty for a paint (on async builders) or a whole frame (on
 large synchronous ones), which reads as a visible flash on every
 poll cycle. Builders receive the fragment as their
 `root`, so existing renderer code carries over unchanged; early
-returns inside the builder still commit whatever was appended
-before they returned.
+returns inside the builder still commit whatever it appended
+before returning.
 
 **Keyed DOM caching:** for sections whose rows hold interactive state
 (textarea drafts, checkboxes, focused inputs) `paintAtomic` isn't
@@ -260,8 +260,8 @@ the left edge captures pointer events, resizes the drawer in
 real-time (pointer capture keeps dragging even if the cursor
 outpaces the handle), and persists the chosen width to
 `localStorage` (key `hyperhive:side-panel-width`) so it
-survives page reload. Width is clamped to CSS `min-width: 320px`
-/ `max-width: 96vw`; the viewport-resize handler re-clamps
+survives page reload. CSS clamps the width between `min-width: 320px`
+and `max-width: 96vw`; the viewport-resize handler re-clamps
 persisted values after a window shrink. File
 previews are type-aware:
 
@@ -286,9 +286,9 @@ Both bind their TCP listener with `SO_REUSEADDR` via
 the previous process's socket release resolves itself, but the two
 binaries differ on the attempt budget. The dashboard's
 `bind_with_retry` (`hive-c0re/src/dashboard/mod.rs`) has **no
-attempt cap** — retrying forever is deliberate, since genuine port
-collisions are preflighted host-side (`lifecycle::{spawn,rebuild}`
-refuses with a clear error, surfaced on the dashboard as a banner),
+attempt cap** — retrying forever is deliberate, since
+`lifecycle::{spawn,rebuild}` preflights genuine port collisions
+host-side (refuses with a clear error, surfaced on the dashboard as a banner),
 so at this layer a persistent `AddrInUse` always reflects a
 recoverable stale socket. Its first 12 attempts log at WARN; after
 that the level drops to INFO so a long-held stale socket doesn't
@@ -325,10 +325,10 @@ at without rebuilding the dist. The cases that matter:
 The gateway upstream config strips the prefix before forwarding to
 the per-agent server, so the agent's Rust routes (`api/state`,
 `events/stream`, `screen/ws`, `login/start`, …) keep their absolute
-paths server-side. Only the browser-facing URLs are gated on the
+paths server-side. Only the browser-facing URLs key off the
 mount prefix.
 
-Subpages (`stats`, `screen`) are served without a trailing slash so
+The router serves subpages (`stats`, `screen`) without a trailing slash so
 the relative-path resolution stays correct: `static/stats.js` from
 `/stats` becomes `/static/stats.js` (last segment `stats` gets
 replaced), not `/stats/static/stats.js`. Adding a trailing slash to