refactor(capabilities): group framework into core/, keep verbs top-level

surfsense_backend/tests/unit/capabilities/access/test_agent_tools.py

@@ -6,7 +6,7 @@ from unittest.mock import AsyncMock
 import pytest
 from pydantic import BaseModel, Field
 
-from app.capabilities.types import BillingUnit, Capability
+from app.capabilities.core.types import BillingUnit, Capability
 from app.services.web_crawl_credit_service import InsufficientCreditsError
 
 pytestmark = pytest.mark.asyncio
@@ -54,7 +54,7 @@ class _FakeSessionCtx:
 @pytest.fixture
 def isolate(monkeypatch):
     """Stub the billing session + charge/gate so tools never hit the DB."""
-    from app.capabilities.access import agent as mod
+    from app.capabilities.core.access import agent as mod
 
     monkeypatch.setattr(mod, "async_session_maker", lambda: _FakeSessionCtx())
     charge = AsyncMock()

surfsense_backend/tests/unit/capabilities/access/test_rate_limit.py

@@ -4,7 +4,7 @@ import pytest
 from fastapi import HTTPException
 from starlette.requests import Request
 
-from app.capabilities.access import rate_limit
+from app.capabilities.core.access import rate_limit
 
 
 def _request(workspace_id: int) -> Request:

surfsense_backend/tests/unit/capabilities/access/test_rest_router.py

@@ -7,7 +7,7 @@ from fastapi import FastAPI
 from httpx import ASGITransport, AsyncClient
 from pydantic import BaseModel
 
-from app.capabilities.types import Capability
+from app.capabilities.core.types import Capability
 from app.db import get_async_session
 from app.users import get_auth_context
 
@@ -36,8 +36,8 @@ _ECHO = Capability(
 
 def _build_app(capabilities, monkeypatch) -> FastAPI:
     """Mount the generated door with auth/workspace/session/rate-limit stubbed."""
-    from app.capabilities.access import rest
-    from app.capabilities.access.rate_limit import enforce_capability_rate_limit
+    from app.capabilities.core.access import rest
+    from app.capabilities.core.access.rate_limit import enforce_capability_rate_limit
 
     monkeypatch.setattr(rest, "check_workspace_access", _noop_async, raising=True)
 
@@ -91,7 +91,7 @@ async def test_input_is_validated_against_the_verb_schema(monkeypatch):
 def test_registered_verbs_appear_on_rest():
     """A verb in the registry shows up as a route with no per-verb wiring."""
     import app.capabilities.web  # noqa: F401  (registers web.* at import)
-    from app.capabilities.access import rest
+    from app.capabilities.core.access import rest
 
     router = rest.build_capabilities_router()
     paths = {route.path for route in router.routes}
@@ -101,7 +101,7 @@ def test_registered_verbs_appear_on_rest():
 
 @pytest.mark.asyncio
 async def test_over_budget_is_blocked_before_the_executor(monkeypatch):
-    from app.capabilities.access import rest
+    from app.capabilities.core.access import rest
     from app.services.web_crawl_credit_service import InsufficientCreditsError
 
     async def _raise(*args, **kwargs):
@@ -123,7 +123,7 @@ async def test_over_budget_is_blocked_before_the_executor(monkeypatch):
 @pytest.mark.asyncio
 async def test_rate_limit_blocks_the_workspace(monkeypatch):
     """The generated route enforces the per-workspace limit (429)."""
-    from app.capabilities.access import rate_limit, rest
+    from app.capabilities.core.access import rate_limit, rest
 
     monkeypatch.setattr(rest, "check_workspace_access", _noop_async, raising=True)
     monkeypatch.setattr(
@@ -153,7 +153,7 @@ async def test_rate_limit_blocks_the_workspace(monkeypatch):
 async def test_success_charges_once(monkeypatch):
     from unittest.mock import AsyncMock
 
-    from app.capabilities.access import rest
+    from app.capabilities.core.access import rest
 
     charge = AsyncMock()
     monkeypatch.setattr(rest, "charge_capability", charge, raising=True)

surfsense_backend/tests/unit/capabilities/test_billing.py

@@ -11,9 +11,9 @@ from uuid import UUID
 
 import pytest
 
-import app.capabilities.billing as billing
-from app.capabilities.billing import charge_capability, gate_capability
-from app.capabilities.types import BillingUnit, CapabilityContext
+import app.capabilities.core.billing as billing
+from app.capabilities.core.billing import charge_capability, gate_capability
+from app.capabilities.core.types import BillingUnit, CapabilityContext
 from app.capabilities.web.scrape.schemas import ScrapeInput, ScrapeOutput, ScrapeRow
 from app.config import config
 from app.services.web_crawl_credit_service import InsufficientCreditsError

surfsense_backend/tests/unit/capabilities/test_registry.py

@@ -7,8 +7,8 @@ import pytest
 from app.capabilities import (
     web,  # noqa: F401  — importing the namespace registers its verbs
 )
-from app.capabilities.store import get_capability
-from app.capabilities.types import BillingUnit
+from app.capabilities.core.store import get_capability
+from app.capabilities.core.types import BillingUnit
 from app.capabilities.web.discover.schemas import DiscoverInput, DiscoverOutput
 from app.capabilities.web.scrape.schemas import ScrapeInput, ScrapeOutput