loops: repo picker + agent/team/org staffing + sidebar edit/delete

Adds the missing pieces the wizard needed and the sidebar controls
around it:

- LoopsWizard is now a 6-step flow (identity → repo → task/topology
  → triggers → repeat → assign agents) plus the existing secrets
  card. ResearchWizard picks up the same repo step and a hard gate
  when the workspace has zero agents.
- New LoopStaffingStep with three tabs — Individual / Team /
  Organization — that mix freely per loop; selections persist via
  new loop_agents / loop_teams / loop_orgs join tables (0035
  migration), each cascading on loop_id so hard-delete stays a
  single-row DELETE.
- Backend CreateLoopRequest / UpdateLoopRequest accept the three
  lists and apply_staffing does a transactional replace-all;
  list_loops / get_loop hydrate the lists via a flattened
  LoopWithStaffing response.
- LoopsList sidebar gains per-row enable/disable, edit (reopens the
  wizard prefilled with the current loop, PATCHes on submit), and
  delete with an inline confirm.
- NoAgentsGate blocks launching a loop or research topic from a
  workspace with no roster; the sidebar `+` buttons also disable
  with a tooltip pointing at the TEAM tier.

Not yet wired: the run driver still fills role slots from the
workspace-wide pool; teaching enqueue_iteration to prefer
loop_agents/loop_teams/loop_orgs is a follow-up.

crates/cm-api/src/routes/loops.rs

@@ -38,11 +38,24 @@ pub struct CreateLoopRequest {
     /// {kind: 'infinite' | 'iters' | 'until', n?: int}
     #[serde(default = "default_repeat")]
     pub repeat_policy: Value,
+    #[serde(default)]
+    pub agents: Vec<AgentSlotInput>,
+    #[serde(default)]
+    pub teams: Vec<Uuid>,
+    #[serde(default)]
+    pub orgs: Vec<Uuid>,
 }
 fn default_repeat() -> Value {
     serde_json::json!({"kind": "infinite"})
 }
 
+#[derive(Deserialize)]
+pub struct AgentSlotInput {
+    pub agent_id: Uuid,
+    #[serde(default)]
+    pub role_slot: Option<String>,
+}
+
 #[derive(Serialize)]
 pub struct LoopCreated {
     pub id: Uuid,
@@ -131,6 +144,8 @@ pub async fn create_loop(
     )
     .await?;
 
+    apply_staffing(&state.pool, id, &body.agents, &body.teams, &body.orgs).await?;
+
     Ok((
         StatusCode::CREATED,
         Json(LoopCreated {
@@ -141,24 +156,72 @@ pub async fn create_loop(
     ))
 }
 
+async fn apply_staffing(
+    pool: &sqlx::PgPool,
+    loop_id: Uuid,
+    agents: &[AgentSlotInput],
+    teams: &[Uuid],
+    orgs: &[Uuid],
+) -> Result<(), ApiError> {
+    let slots: Vec<cm_db::repo::loops::AgentSlot> = agents
+        .iter()
+        .map(|a| cm_db::repo::loops::AgentSlot {
+            agent_id: a.agent_id,
+            role_slot: a.role_slot.clone(),
+        })
+        .collect();
+    cm_db::repo::loops::set_agents(pool, loop_id, &slots).await?;
+    cm_db::repo::loops::set_teams(pool, loop_id, teams).await?;
+    cm_db::repo::loops::set_orgs(pool, loop_id, orgs).await?;
+    Ok(())
+}
+
+#[derive(Serialize)]
+pub struct LoopWithStaffing {
+    #[serde(flatten)]
+    pub inner: cm_db::repo::loops::Loop,
+    pub agents: Vec<cm_db::repo::loops::AgentSlot>,
+    pub teams: Vec<Uuid>,
+    pub orgs: Vec<Uuid>,
+}
+
+async fn hydrate_staffing(
+    pool: &sqlx::PgPool,
+    inner: cm_db::repo::loops::Loop,
+) -> Result<LoopWithStaffing, ApiError> {
+    let id = inner.id;
+    let agents = cm_db::repo::loops::agents(pool, id).await?;
+    let teams = cm_db::repo::loops::teams(pool, id).await?;
+    let orgs = cm_db::repo::loops::orgs(pool, id).await?;
+    Ok(LoopWithStaffing {
+        inner,
+        agents,
+        teams,
+        orgs,
+    })
+}
+
 pub async fn list_loops(
     State(state): State<AppState>,
     Authed(user): Authed,
-) -> Result<Json<Vec<cm_db::repo::loops::Loop>>, ApiError> {
-    Ok(Json(
-        cm_db::repo::loops::list(&state.pool, user.workspace_id.as_uuid()).await?,
-    ))
+) -> Result<Json<Vec<LoopWithStaffing>>, ApiError> {
+    let loops = cm_db::repo::loops::list(&state.pool, user.workspace_id.as_uuid()).await?;
+    let mut out = Vec::with_capacity(loops.len());
+    for l in loops {
+        out.push(hydrate_staffing(&state.pool, l).await?);
+    }
+    Ok(Json(out))
 }
 
 pub async fn get_loop(
     State(state): State<AppState>,
     Authed(user): Authed,
     Path(id): Path<Uuid>,
-) -> Result<Json<cm_db::repo::loops::Loop>, ApiError> {
-    cm_db::repo::loops::get(&state.pool, id, user.workspace_id.as_uuid())
+) -> Result<Json<LoopWithStaffing>, ApiError> {
+    let inner = cm_db::repo::loops::get(&state.pool, id, user.workspace_id.as_uuid())
         .await?
-        .map(Json)
-        .ok_or(ApiError::NotFound)
+        .ok_or(ApiError::NotFound)?;
+    Ok(Json(hydrate_staffing(&state.pool, inner).await?))
 }
 
 #[derive(Deserialize)]
@@ -169,6 +232,12 @@ pub struct UpdateLoopRequest {
     pub task_template: String,
     pub triggers: Value,
     pub repeat_policy: Value,
+    #[serde(default)]
+    pub agents: Vec<AgentSlotInput>,
+    #[serde(default)]
+    pub teams: Vec<Uuid>,
+    #[serde(default)]
+    pub orgs: Vec<Uuid>,
 }
 
 pub async fn patch_loop(
@@ -199,6 +268,7 @@ pub async fn patch_loop(
         },
     )
     .await?;
+    apply_staffing(&state.pool, id, &body.agents, &body.teams, &body.orgs).await?;
     Ok(StatusCode::NO_CONTENT)
 }