feat(hierarchies): route templates — group-declared, per-app fan-out (M4a)

§4.5 of the groups/project-tool design. A group declares a route ONCE; the
tree apply fans it out into one concrete per-app_id route on every descendant
app — instantiation, not inheritance (the cross-app isolation boundary is
unchanged; expanded rows stay app-owned).

- Migration 0053: `route_templates` table (group-owned) + `routes.from_template`
  provenance column + index.
- `template_repo.rs`: tx-aware CRUD + chain-load (mirrors group_repo/route_repo).
- Manifest: `[group]` `[[route_templates]]`; build_bundle emits them; rejected
  on an app node (422).
- Apply: group nodes reconcile template rows (create/update/delete via the
  plan); tree Phase B expands each chain template into a concrete route per
  descendant app node — placeholders {app_slug}/{env}/{var:NAME} resolved per
  app (unknown var/placeholder = hard error), script bound nearest-owner-wins.
  Idempotent via from_template (diffed create/update-as-replace/delete; re-apply
  is no-churn, --prune reaps expansions). Collision with a hand-declared route,
  or between two templates, is a hard error. Each RESOLVED expansion is
  validated like a hand-declared route (reserved-path, path/host parse,
  host-claim) so a {var:}-injected path or unclaimed strict host can't slip in.
- Plan: route-template diff at the group node + blast-radius (descendant app
  count in this apply); state_token folds each template (edit trips StateMoved).
- Authz: declaring → GroupScriptsWrite; an app receiving expansions →
  AppWriteRoute (gated even with no hand-declared routes).
- Tests: tests/templates.rs (fan-out + per-slug + idempotent-stable-ids +
  prune-reap + collision-rejected); placeholder/validation unit tests; schema
  golden reblessed.

Reviewed (no CRITICAL/HIGH; isolation core verified sound). Closed the two
validation-parity MEDIUMs (host-claim + reserved-path/pattern on expansions)
and added an out-of-apply-descendant prune warning. Scope: expansion targets
app nodes in the tree apply (not yet cross-repo descendants); {var:NAME} uses
committed vars. M4b (trigger templates) reuses this engine next.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

crates/picloud-cli/src/manifest.rs

@@ -53,6 +53,11 @@ pub struct Manifest {
     /// resolution (§5.5). Allowed on both app and group manifests.
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub extension_points: Vec<ManifestExtensionPoint>,
+    /// `[[route_templates]]` — GROUP-only route declarations that fan out into a
+    /// concrete route on every descendant app at apply time (§4.5, M4a). String
+    /// fields may carry `{app_slug}`/`{env}`/`{var:NAME}` placeholders.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub route_templates: Vec<ManifestRouteTemplate>,
 }
 
 impl Manifest {
@@ -275,6 +280,32 @@ pub struct ManifestRoute {
     pub enabled: bool,
 }
 
+/// `[[route_templates]]` — a route declared once on a group, fanned out per
+/// descendant app (§4.5, M4a). Same shape as [`ManifestRoute`] plus a `name`
+/// (the per-group identity/upsert key).
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct ManifestRouteTemplate {
+    /// Per-group template name (identity/upsert key).
+    pub name: String,
+    pub script: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub method: Option<String>,
+    pub host_kind: HostKind,
+    #[serde(default, skip_serializing_if = "String::is_empty")]
+    pub host: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub host_param_name: Option<String>,
+    pub path_kind: PathKind,
+    pub path: String,
+    #[serde(default, skip_serializing_if = "is_sync")]
+    pub dispatch_mode: DispatchMode,
+    #[serde(
+        default = "picloud_shared::default_true",
+        skip_serializing_if = "is_true"
+    )]
+    pub enabled: bool,
+}
+
 /// Triggers grouped by kind (arrays-of-tables: `[[triggers.cron]]`, …).
 #[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize)]
 pub struct ManifestTriggers {
@@ -511,6 +542,7 @@ mod tests {
                 name: "theme".into(),
                 default: Some("default-theme".into()),
             }],
+            route_templates: Vec::new(),
         }
     }
 
@@ -615,6 +647,7 @@ mod tests {
             secrets: ManifestSecrets::default(),
             vars: BTreeMap::new(),
             extension_points: Vec::new(),
+            route_templates: Vec::new(),
         };
         let text = m.to_toml().unwrap();
         assert!(!text.contains("[[scripts]]"), "got:\n{text}");