templates: 5 research team templates + category filtering

Adds the operator's five categorized research team archetypes:

  1. codebase_research — code archeologist, architecture mapper,
     flow tracer, vault scribe. Produces Obsidian vault entries
     under Codebases/<repo>/ that make future missions faster.
  2. papers_research — domain scout, paper reader, library curator.
     Pulls arXiv / Semantic Scholar / conference proceedings, keeps
     a structured local library under Papers/<topic>/.
  3. insight_research — implementation tracker, novelty hunter,
     publication drafter. Bidirectional loop that spots
     publication-worthy novelty in our own implementations of
     external papers.
  4. continuous_research — signal harvester, ranker, digest writer.
     Standing sweep of RSS + arXiv daily + GitHub trending; produces
     a rolling ContinuousResearch/<date>/digest.md.
  5. continuous_improvement — brain inspector, improvement proposer,
     improvement evaluator. Standing self-audit that files level-up
     proposals for the operator to review + measures the outcome.

Each template ships with role system_prompts + brain_seeds authored
in the same voice as the existing backend/frontend/etc templates —
evidence-first, redlines called out, no invention.

Schema + code:
  - 0057_team_templates_category.sql — new column with
    CHECK (research | development | security | ops). Existing rows
    default to 'development'.
  - team_templates::UpsertBuiltin + TeamTemplate carry category
    (with default_category = 'development' fallback for
    Serialize/Deserialize compatibility).
  - team_template_loader reads `category = "..."` from the TOML;
    absent defaults to 'development' so old templates keep working.
  - Wizard step 3 filters:
      Research teams panel → templates.filter(t.category==='research')
      Development teams panel → templates.filter(t.category==='development')
    Operator can no longer accidentally pick backend as their
    "research team".

Test fixture updated with category="development".

The templates ship in the server image via the existing
`COPY templates /etc/clawmates/templates` line — no Dockerfile
change needed.

crates/cm-db/src/repo/team_templates.rs

@@ -27,6 +27,9 @@ pub struct TeamTemplate {
     pub config: Value,
     pub source: String,
     pub workspace_id: Option<Uuid>,
+    /// 'research' | 'development' | 'security' | 'ops'
+    #[serde(default = "default_category")]
+    pub category: String,
     #[serde(with = "time::serde::rfc3339")]
     pub created_at: OffsetDateTime,
     #[serde(with = "time::serde::rfc3339")]
@@ -74,9 +77,17 @@ pub struct UpsertBuiltin<'a> {
     pub version: i32,
     pub description: Option<&'a str>,
     pub config: Value,
+    /// 'research' | 'development' | 'security' | 'ops'. Defaults to
+    /// 'development' at the loader level so old TOML files without a
+    /// category still upsert as coding teams.
+    pub category: &'a str,
     pub roles: Vec<UpsertBuiltinRole<'a>>,
 }
 
+fn default_category() -> String {
+    "development".to_string()
+}
+
 /// Upsert a builtin template + its roles in one txn. Idempotent.
 pub async fn upsert_builtin(pool: &PgPool, b: UpsertBuiltin<'_>) -> Result<Uuid, DbError> {
     let id = b.id;
@@ -85,8 +96,8 @@ pub async fn upsert_builtin(pool: &PgPool, b: UpsertBuiltin<'_>) -> Result<Uuid,
     sqlx::query(
         "INSERT INTO team_templates
            (id, key, name, stack, default_topology, risk_profile,
-            mcp_bundles, version, description, config, source, workspace_id)
-         VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,'builtin',NULL)
+            mcp_bundles, version, description, config, source, workspace_id, category)
+         VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,'builtin',NULL,$11)
          ON CONFLICT (id) DO UPDATE SET
              key              = EXCLUDED.key,
              name             = EXCLUDED.name,
@@ -97,6 +108,7 @@ pub async fn upsert_builtin(pool: &PgPool, b: UpsertBuiltin<'_>) -> Result<Uuid,
              version          = EXCLUDED.version,
              description      = EXCLUDED.description,
              config           = EXCLUDED.config,
+             category         = EXCLUDED.category,
              updated_at       = now()",
     )
     .bind(id)
@@ -109,6 +121,7 @@ pub async fn upsert_builtin(pool: &PgPool, b: UpsertBuiltin<'_>) -> Result<Uuid,
     .bind(b.version)
     .bind(b.description)
     .bind(&b.config)
+    .bind(b.category)
     .execute(&mut *tx)
     .await?;
 
@@ -142,7 +155,7 @@ pub async fn list_all(pool: &PgPool) -> Result<Vec<TeamTemplate>, DbError> {
     let rows = sqlx::query(
         "SELECT id, key, name, stack, default_topology, risk_profile,
                 mcp_bundles, version, description, config, source,
-                workspace_id, created_at, updated_at
+                workspace_id, category, created_at, updated_at
          FROM team_templates
          WHERE source = 'builtin' OR workspace_id IS NOT NULL
          ORDER BY source DESC, name ASC",
@@ -157,7 +170,7 @@ pub async fn get(pool: &PgPool, id: Uuid) -> Result<Option<TeamTemplateDetail>,
     let Some(t) = sqlx::query(
         "SELECT id, key, name, stack, default_topology, risk_profile,
                 mcp_bundles, version, description, config, source,
-                workspace_id, created_at, updated_at
+                workspace_id, category, created_at, updated_at
          FROM team_templates WHERE id = $1",
     )
     .bind(id)
@@ -192,7 +205,7 @@ pub async fn get_by_key(pool: &PgPool, key: &str) -> Result<Option<TeamTemplate>
     let row = sqlx::query(
         "SELECT id, key, name, stack, default_topology, risk_profile,
                 mcp_bundles, version, description, config, source,
-                workspace_id, created_at, updated_at
+                workspace_id, category, created_at, updated_at
          FROM team_templates WHERE key = $1",
     )
     .bind(key)
@@ -216,6 +229,9 @@ fn row_to_template(r: sqlx::postgres::PgRow) -> TeamTemplate {
         config: r.get("config"),
         source: r.get("source"),
         workspace_id: r.get("workspace_id"),
+        category: r
+            .try_get("category")
+            .unwrap_or_else(|_| "development".to_string()),
         created_at: r.get("created_at"),
         updated_at: r.get("updated_at"),
     }