tools: add scope column for capability model

Add a 'scope' TEXT column (default 'homelab') to the tools table so tools
can be namespaced by scope (e.g. "homelab:restart", "datacenter:reboot").
Backward-compat: bare name defaults to "homelab" scope.

Changes:
- Migration #1: ALTER TABLE tools ADD COLUMN scope
- store.Tool: add Scope field, update all SQL and scanTool()
- ipc.Tool DTO and request types: add Scope field
- CoreAPI interface: pass scope in ProposeTool/EnableTool
- storeAPI adapters: forward scope
- cmd/mavend/voice: pass scope (empty → homelab)
- cmd/mavweb/tools: show scope column in UI tables, hidden fields
- All tests updated for scope field
- Migration test made dynamic (startVer = len(migrations))

internal/ipc/api.go

@@ -157,6 +157,7 @@ type sinceResp struct {
 // inert scaffold; 'enabled' is runnable. The executor only runs 'enabled'.
 type Tool struct {
 	Name        string    `json:"name"`
+	Scope       string    `json:"scope"`
 	Cmd         []string  `json:"cmd"`
 	Destructive bool      `json:"destructive"`
 	Status      string    `json:"status"`
@@ -167,6 +168,7 @@ type Tool struct {
 
 type proposeToolReq struct {
 	Name      string    `json:"name"`
+	Scope     string    `json:"scope"`
 	Utterance string    `json:"utterance"`
 	Ts        time.Time `json:"ts"`
 }
@@ -175,6 +177,7 @@ type proposeToolResp struct {
 }
 type enableToolReq struct {
 	Name        string    `json:"name"`
+	Scope       string    `json:"scope"`
 	Cmd         []string  `json:"cmd"`
 	Destructive bool      `json:"destructive"`
 	Ts          time.Time `json:"ts"`
@@ -227,8 +230,9 @@ type CoreAPI interface {
 	// Enable/DisableTool gate at AuthStepUp (allowlist mutation, human-only);
 	// ProposeTool is maven-callable (no step-up — she has no passkey).
 	// LookupTool/ListTools read them.
-	ProposeTool(ctx context.Context, name, utterance string, ts time.Time) (bool, error)
-	EnableTool(ctx context.Context, name string, cmd []string, destructive bool, ts time.Time) error
+	// scope defaults to "homelab" when empty.
+	ProposeTool(ctx context.Context, name, utterance, scope string, ts time.Time) (bool, error)
+	EnableTool(ctx context.Context, name string, cmd []string, destructive bool, scope string, ts time.Time) error
 	DisableTool(ctx context.Context, name string) error
 	LookupTool(ctx context.Context, name string) (Tool, error)
 	ListTools(ctx context.Context, status string) ([]Tool, error)