tools: add scope column for capability model

Add a 'scope' TEXT column (default 'homelab') to the tools table so tools
can be namespaced by scope (e.g. "homelab:restart", "datacenter:reboot").
Backward-compat: bare name defaults to "homelab" scope.

Changes:
- Migration #1: ALTER TABLE tools ADD COLUMN scope
- store.Tool: add Scope field, update all SQL and scanTool()
- ipc.Tool DTO and request types: add Scope field
- CoreAPI interface: pass scope in ProposeTool/EnableTool
- storeAPI adapters: forward scope
- cmd/mavend/voice: pass scope (empty → homelab)
- cmd/mavweb/tools: show scope column in UI tables, hidden fields
- All tests updated for scope field
- Migration test made dynamic (startVer = len(migrations))

internal/ipc/api.go

@@ -157,6 +157,7 @@ type sinceResp struct {
 // inert scaffold; 'enabled' is runnable. The executor only runs 'enabled'.
 type Tool struct {
 	Name        string    `json:"name"`
+	Scope       string    `json:"scope"`
 	Cmd         []string  `json:"cmd"`
 	Destructive bool      `json:"destructive"`
 	Status      string    `json:"status"`
@@ -167,6 +168,7 @@ type Tool struct {
 
 type proposeToolReq struct {
 	Name      string    `json:"name"`
+	Scope     string    `json:"scope"`
 	Utterance string    `json:"utterance"`
 	Ts        time.Time `json:"ts"`
 }
@@ -175,6 +177,7 @@ type proposeToolResp struct {
 }
 type enableToolReq struct {
 	Name        string    `json:"name"`
+	Scope       string    `json:"scope"`
 	Cmd         []string  `json:"cmd"`
 	Destructive bool      `json:"destructive"`
 	Ts          time.Time `json:"ts"`
@@ -227,8 +230,9 @@ type CoreAPI interface {
 	// Enable/DisableTool gate at AuthStepUp (allowlist mutation, human-only);
 	// ProposeTool is maven-callable (no step-up — she has no passkey).
 	// LookupTool/ListTools read them.
-	ProposeTool(ctx context.Context, name, utterance string, ts time.Time) (bool, error)
-	EnableTool(ctx context.Context, name string, cmd []string, destructive bool, ts time.Time) error
+	// scope defaults to "homelab" when empty.
+	ProposeTool(ctx context.Context, name, utterance, scope string, ts time.Time) (bool, error)
+	EnableTool(ctx context.Context, name string, cmd []string, destructive bool, scope string, ts time.Time) error
 	DisableTool(ctx context.Context, name string) error
 	LookupTool(ctx context.Context, name string) (Tool, error)
 	ListTools(ctx context.Context, status string) ([]Tool, error)

internal/ipc/client.go

@@ -309,16 +309,16 @@ func (c *Client) RecentNotes(ctx context.Context, n int) ([]Note, error) {
 	return out, nil
 }
 
-func (c *Client) ProposeTool(ctx context.Context, name, utterance string, ts time.Time) (bool, error) {
+func (c *Client) ProposeTool(ctx context.Context, name, utterance, scope string, ts time.Time) (bool, error) {
 	var r proposeToolResp
-	if err := c.call(ctx, MethodProposeTool, proposeToolReq{Name: name, Utterance: utterance, Ts: ts}, &r); err != nil {
+	if err := c.call(ctx, MethodProposeTool, proposeToolReq{Name: name, Scope: scope, Utterance: utterance, Ts: ts}, &r); err != nil {
 		return false, err
 	}
 	return r.Proposed, nil
 }
 
-func (c *Client) EnableTool(ctx context.Context, name string, cmd []string, destructive bool, ts time.Time) error {
-	return c.call(ctx, MethodEnableTool, enableToolReq{Name: name, Cmd: cmd, Destructive: destructive, Ts: ts}, nil)
+func (c *Client) EnableTool(ctx context.Context, name string, cmd []string, destructive bool, scope string, ts time.Time) error {
+	return c.call(ctx, MethodEnableTool, enableToolReq{Name: name, Scope: scope, Cmd: cmd, Destructive: destructive, Ts: ts}, nil)
 }
 
 func (c *Client) DisableTool(ctx context.Context, name string) error {

internal/ipc/server.go

@@ -144,13 +144,13 @@ func (a *storeAPI) RecentNotes(ctx context.Context, n int) ([]Note, error) {
 	return out, nil
 }
 
-func (a *storeAPI) ProposeTool(ctx context.Context, name, utterance string, ts time.Time) (bool, error) {
-	ok, err := a.s.ProposeTool(ctx, name, utterance, ts)
+func (a *storeAPI) ProposeTool(ctx context.Context, name, utterance, scope string, ts time.Time) (bool, error) {
+	ok, err := a.s.ProposeTool(ctx, name, utterance, scope, ts)
 	return ok, mapErr(err)
 }
 
-func (a *storeAPI) EnableTool(ctx context.Context, name string, cmd []string, destructive bool, ts time.Time) error {
-	return mapErr(a.s.EnableTool(ctx, name, cmd, destructive, ts))
+func (a *storeAPI) EnableTool(ctx context.Context, name string, cmd []string, destructive bool, scope string, ts time.Time) error {
+	return mapErr(a.s.EnableTool(ctx, name, cmd, destructive, scope, ts))
 }
 
 func (a *storeAPI) DisableTool(ctx context.Context, name string) error {
@@ -184,8 +184,8 @@ func (a *storeAPI) ListTools(ctx context.Context, status string) ([]Tool, error)
 
 func toTool(t store.Tool) Tool {
 	return Tool{
-		Name: t.Name, Cmd: t.Cmd, Destructive: t.Destructive, Status: t.Status,
-		Utterance: t.Utterance, Created: t.CreatedTs, Updated: t.UpdatedTs,
+		Name: t.Name, Scope: t.Scope, Cmd: t.Cmd, Destructive: t.Destructive,
+		Status: t.Status, Utterance: t.Utterance, Created: t.CreatedTs, Updated: t.UpdatedTs,
 	}
 }
 
@@ -567,7 +567,7 @@ func (s *Server) dispatch(ctx context.Context, req Request) (json.RawMessage, er
 		if err := unmarshalParams(req.Params, &p); err != nil {
 			return nil, err
 		}
-		ok, err := s.api.ProposeTool(ctx, p.Name, p.Utterance, p.Ts)
+		ok, err := s.api.ProposeTool(ctx, p.Name, p.Utterance, p.Scope, p.Ts)
 		if err != nil {
 			return nil, err
 		}
@@ -578,7 +578,7 @@ func (s *Server) dispatch(ctx context.Context, req Request) (json.RawMessage, er
 		if err := unmarshalParams(req.Params, &p); err != nil {
 			return nil, err
 		}
-		return marshalResult(nil), s.api.EnableTool(ctx, p.Name, p.Cmd, p.Destructive, p.Ts)
+		return marshalResult(nil), s.api.EnableTool(ctx, p.Name, p.Cmd, p.Destructive, p.Scope, p.Ts)
 
 	case MethodDisableTool:
 		var p disableToolReq