feat(web): expose bounded capability snapshot endpoint

[seekskyworld]

Problem

Implements the read-only protocol slice of #346. The Web workbench had capability data only inside the full snapshot, with no focused endpoint for capability panels and reconnect refreshes.

Value

Operators can request the existing bounded Subagent/Workflow/Terminal projections directly without the browser reconstructing lifecycle state.

Approach

Expose authenticated GET /api/capabilities, using the existing webCapabilitySnapshot projection and active Session identity. No new registry or control path is introduced.

Validation

• npx tsc --noEmit
• git diff --check

Impact

• User-visible behavior: enables focused capability-panel refreshes.
• Model-visible context/tools: none.
• Runtime/lifecycle: read-only projection only.
• Persisted config/data: none.
• Compatibility/risk: additive endpoint; lifecycle controls remain owner-specific follow-ups.