slice 3: 6 team templates seeded from TOML recipes

Team templates are the canonical rosters + tool bundles that mint
concrete teams for a mission. Every builtin ships as a TOML recipe
under templates/teams/*.toml, loaded into the DB at server boot.

Migration 0048 adds:
  - team_templates    (id, key, name, stack, default_topology,
                       risk_profile, mcp_bundles, version, source,
                       workspace_id)
  - template_roles    (m2m: template_id + slot; system_prompt,
                       skills[], brain_seed)
  - teams gets template_id + template_version for level-up lineage

Ships 6 builtins:
  - rust_sdlc  — planner/coder/tester/reviewer/committer for Rust
  - backend    — api_designer/db_engineer/coder/tester/committer
                 (Postgres, DuckDB, graph DBs, wire protocols)
  - frontend   — designer/coder/tester/committer (React + Tailwind + ShadCN)
  - mobile     — designer/coder/tester/committer (Expo, RN, iOS, Android)
  - gpu        — arch_analyst/kernel_author/bench_engineer/coder/committer
                 (CUDA, Metal, ROCm from Rust)
  - threejs    — scene_designer/coder/shader_author/perf_engineer/
                 committer (three.js, WebGL, WebGPU)

Each role has a versioned system_prompt + skill list + brain_seed
markdown. Skills column is a name array today; Slice 3.5a promotes it
to a typed m2m join with the real skills catalog.

Server boot:
  - team_template_loader::load_builtins reads TOML from
    /etc/clawmates/templates/teams (container) or templates/teams (dev),
    upserts idempotently. Deterministic uuid per template key (sha256
    of a fixed namespace + key) so ids are stable across boots.
  - Dockerfile copies templates/ to /etc/clawmates/templates.

Read API:
  - GET /api/team-templates       — list all
  - GET /api/team-templates/{id}  — detail with roles

Wizard:
  - Step 3 rewired from a raw team_id text field to a template picker
    with "LLM auto-provision" as the default option + one card per
    builtin, showing stack, topology, risk profile, and description.
  - Mission create now passes team_template_id (not team_id) so phase
    execution knows which template to mint from.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

crates/cm-api/src/routes/mod.rs

@@ -14,6 +14,7 @@ pub mod health;
 pub mod identity;
 pub mod loops;
 pub mod missions;
+pub mod team_templates;
 pub mod nodes;
 pub mod oauth;
 pub mod orgs;

crates/cm-api/src/routes/team_templates.rs

@@ -0,0 +1,33 @@
+//! `/api/team-templates/*` — expose builtin + workspace team templates
+//! to the wizard's team-picker step.
+
+use axum::{
+    Json,
+    extract::{Path, State},
+};
+use cm_db::repo::team_templates::{TeamTemplate, TeamTemplateDetail};
+use uuid::Uuid;
+
+use crate::{ApiError, AppState, Authed};
+
+pub async fn list(
+    State(state): State<AppState>,
+    Authed(_user): Authed,
+) -> Result<Json<Vec<TeamTemplate>>, ApiError> {
+    // Builtins are cross-workspace; workspace-authored templates are
+    // filtered by the repo layer (this route only exposes builtins for
+    // now — Slice 3 doesn't ship a workspace template editor yet).
+    let rows = cm_db::repo::team_templates::list_all(&state.pool).await?;
+    Ok(Json(rows))
+}
+
+pub async fn get(
+    State(state): State<AppState>,
+    Authed(_user): Authed,
+    Path(id): Path<Uuid>,
+) -> Result<Json<TeamTemplateDetail>, ApiError> {
+    let d = cm_db::repo::team_templates::get(&state.pool, id)
+        .await?
+        .ok_or(ApiError::NotFound)?;
+    Ok(Json(d))
+}