refactor(hive-c0re): group src-root files into submodules

stores/ (sqlite-backed host stores + db helper), stats/, agent_config/,
workers/ — pure git-mv moves; crate-root re-exports keep every
crate::<module> path compiling. flake_check stays at root (synchronous
approval-flow validation, not a background worker)

hive-c0re/src/tool_groups.rs

@@ -1,120 +0,0 @@
-//! Per-agent tool-group configuration. Stored at
-//! `/var/lib/hyperhive/meta/tool-groups.json` alongside `topology.json`
-//! and the meta `flake.nix`.
-//!
-//! Format: a JSON object mapping agent name to an array of
-//! `hive_sh4re::ToolGroup` `snake_case` strings:
-//!
-//! ```json
-//! {
-//!   "alice": ["messaging", "meta", "inbox", "lifecycle"],
-//!   "bob":   ["messaging", "meta", "inbox"]
-//! }
-//! ```
-//!
-//! An absent entry (or an absent file) means "use the harness default"
-//! (`AGENT_DEFAULT`: `messaging + meta + inbox + execution`). `render_flake`
-//! in `meta.rs` reads this file and injects `HIVE_TOOL_GROUPS` into each
-//! agent's systemd service env; agents with no entry get no env var and the
-//! harness falls back to `AGENT_DEFAULT`.
-//!
-//! Write path: `set_groups` is called from the dashboard action handler
-//! that the operator uses to grant/revoke tool groups per agent.
-
-use std::collections::BTreeMap;
-use std::path::PathBuf;
-
-use anyhow::Context as _;
-
-const TOOL_GROUPS_FILE: &str = "tool-groups.json";
-
-#[must_use]
-pub fn tool_groups_path() -> PathBuf {
-    crate::meta::meta_dir().join(TOOL_GROUPS_FILE)
-}
-
-/// Read the per-agent tool-group map. Returns an empty map when the
-/// file is absent or unparsable — callers treat a missing entry as
-/// "use role default".
-#[must_use]
-pub fn read() -> BTreeMap<String, Vec<String>> {
-    let path = tool_groups_path();
-    let Ok(raw) = std::fs::read_to_string(&path) else {
-        return BTreeMap::new();
-    };
-    serde_json::from_str(&raw).unwrap_or_default()
-}
-
-/// Look up the configured tool groups for one agent. Returns an empty
-/// vec when the agent has no entry — callers should treat this as
-/// "use the harness role default."
-#[must_use]
-pub fn groups_for(name: &str) -> Vec<String> {
-    read().get(name).cloned().unwrap_or_default()
-}
-
-/// Persist the full tool-groups map. Sorted JSON output keeps diffs
-/// minimal. Use `set_groups` (or `remove_agent`) from outside this
-/// module — they go through the validated write path.
-fn write(map: &BTreeMap<String, Vec<String>>) -> std::io::Result<()> {
-    let path = tool_groups_path();
-    if let Some(parent) = path.parent() {
-        std::fs::create_dir_all(parent)?;
-    }
-    let text = serde_json::to_string_pretty(map)
-        .map_err(|e| std::io::Error::new(std::io::ErrorKind::InvalidData, e))?;
-    std::fs::write(&path, format!("{text}\n"))
-}
-
-/// Validate a slice of group name strings against `ToolGroup::ALL`.
-/// Returns `Ok(())` when all names are known, or `Err` listing the
-/// unrecognised names so callers can surface a useful error message.
-pub fn validate_groups(groups: &[String]) -> anyhow::Result<()> {
-    let valid: std::collections::BTreeSet<&str> = hive_sh4re::ToolGroup::ALL
-        .iter()
-        .map(|g| g.as_str())
-        .collect();
-    let unknown: Vec<&str> = groups
-        .iter()
-        .map(String::as_str)
-        .filter(|s| !valid.contains(s))
-        .collect();
-    if unknown.is_empty() {
-        Ok(())
-    } else {
-        anyhow::bail!(
-            "unknown tool group(s): {}; valid names are: {}",
-            unknown.join(", "),
-            hive_sh4re::ToolGroup::ALL
-                .iter()
-                .map(|g| g.as_str())
-                .collect::<Vec<_>>()
-                .join(", ")
-        )
-    }
-}
-
-/// Set the tool groups for one agent and persist the map. An empty
-/// `groups` vec removes the entry (agent reverts to role default).
-/// Returns an error if any name is not in `ToolGroup::ALL`.
-pub fn set_groups(name: &str, groups: &[String]) -> anyhow::Result<()> {
-    if !groups.is_empty() {
-        validate_groups(groups)?;
-    }
-    let mut current = read();
-    if groups.is_empty() {
-        current.remove(name);
-    } else {
-        current.insert(name.to_owned(), groups.to_vec());
-    }
-    write(&current).with_context(|| format!("write tool-groups for {name}"))
-}
-
-/// Drop the entry for an agent that is being destroyed. Idempotent.
-pub fn remove_agent(name: &str) -> std::io::Result<()> {
-    let mut current = read();
-    if current.remove(name).is_some() {
-        write(&current)?;
-    }
-    Ok(())
-}