dashboard: pass kinds= on the 4 unfiltered /api/dashboard/stream subscribers

Part 1 of the dashboard-event-stream-split epic: the server-side
kinds= allow-list already exists and flow.js already uses it
(hive-c0re/src/dashboard/state_snapshot.rs). tabs.js, builds.js,
core.js, and logs.js were the remaining 4 subscribers still taking
every wire kind unfiltered — pure subscription discipline, no new
endpoint needed, per the investigation on the tracking issue.

Each kinds= list is read directly off that page's own existing
MUTATION_HANDLERS/SSE_HANDLERS dispatch table (tabs.js also needs
sent, checked separately for the operator inbox) — a kind not in a
page's table was already a silent no-op today, so this only removes
wire/parse/dispatch-lookup cost for kinds a page never acted on, zero
behavior change.

Note for reviewers: the SharedWorker (stream-worker.js) multiplexes
by exact URL string, so pages that used to share one unfiltered
upstream connection when open simultaneously (e.g. dashboard.html +
builds.html in two tabs) will now each hold their own filtered
connection instead, since their kinds= differ. Each connection is
still a single cheap SSE stream carrying only what that page acts on
— net win over the shared-but-bloated connection this replaces.

frontend/packages/dashboard/src/logs.js

@@ -384,8 +384,12 @@ import '@hive/shared/hive-tab-strip.js';
   loadContainerLists();
 
   // Subscribe to the dashboard SSE stream for audit live-appends.
+  // kinds= narrows this from all 17 wire kinds down to the 1 this page
+  // acts on. This page was one of 4 unfiltered `/api/dashboard/stream`
+  // subscribers before this (subscription discipline, part 1 of the
+  // dashboard-event-stream-split issue).
   {
-    const es = openStream('/api/dashboard/stream');
+    const es = openStream('/api/dashboard/stream?kinds=audit_entry_added');
     if (es) {
       es.onmessage = (e) => {
         let ev;