feat(suppress): group-suppress warnings + ls + journey + docs (M1.5)

- dangling_suppress_warnings takes an ApplyOwner and walks the group's own
  chain (GROUP_CHAIN_LEVELS_CTE) for a group node; runs for both owners.
- GET /groups/{id}/suppressions + `pic suppress ls --group` (client + cmd +
  main.rs; --app/--group mutually exclusive).
- suppress journey: a child group declines a parent template for its subtree;
  suppress ls --group shows the marker. Docs §4.5 + CLAUDE.md move group-level
  suppression from Deferred to implemented.

Completes M1. (An unrelated pre-existing email_inbound dispatch-timing flake
passes in isolation.)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/client.rs

@@ -1385,6 +1385,19 @@ impl Client {
             .await?;
         decode(resp).await
     }
+
+    /// §11 tail M1: a group's own suppressions (declined for its whole subtree).
+    pub async fn group_suppressions_list(&self, group_ident: &str) -> Result<Vec<SuppressionDto>> {
+        let ident = seg(group_ident);
+        let resp = self
+            .request(
+                Method::GET,
+                &format!("/api/v1/admin/groups/{ident}/suppressions"),
+            )
+            .send()
+            .await?;
+        decode(resp).await
+    }
 }
 
 /// One row of the §11 tail suppression report.

crates/picloud-cli/src/cmds/suppress.rs

@@ -1,18 +1,23 @@
-//! `pic suppress ls --app <a>` — read-only view of an app's §11 tail
-//! per-app opt-outs: the inherited group templates it declines. App-only;
-//! authoring is declarative via the `[suppress]` block (`triggers = [...]`
-//! handler script names, `routes = [...]` paths).
+//! `pic suppress ls --app <a>` / `--group <g>` — read-only view of an owner's
+//! §11 tail opt-outs: the inherited group templates it declines. An app declines
+//! for itself; a group declines for its whole subtree (§11 tail M1). Authoring
+//! is declarative via the `[suppress]` block (`triggers = [...]` handler script
+//! names, `routes = [...]` paths).
 
-use anyhow::Result;
+use anyhow::{bail, Result};
 
 use crate::client::Client;
 use crate::config;
 use crate::output::{OutputMode, Table};
 
-pub async fn ls(app: &str, mode: OutputMode) -> Result<()> {
+pub async fn ls(app: Option<&str>, group: Option<&str>, mode: OutputMode) -> Result<()> {
     let creds = config::resolve()?;
     let client = Client::from_creds(&creds)?;
-    let items = client.suppressions_list(app).await?;
+    let items = match (app, group) {
+        (Some(a), None) => client.suppressions_list(a).await?,
+        (None, Some(g)) => client.group_suppressions_list(g).await?,
+        _ => bail!("provide exactly one of --app or --group"),
+    };
 
     let mut table = Table::new(["kind", "reference"]);
     for s in &items {

crates/picloud-cli/src/main.rs

@@ -587,10 +587,14 @@ enum CollectionsCmd {
 
 #[derive(Subcommand)]
 enum SuppressCmd {
-    /// List the inherited templates an app declines (§11 tail). App-only.
+    /// List the inherited templates an owner declines (§11 tail). Exactly one
+    /// of `--app` (declines for itself) or `--group` (declines for its whole
+    /// subtree, §11 tail M1).
     Ls {
+        #[arg(long, conflicts_with = "group")]
+        app: Option<String>,
         #[arg(long)]
-        app: String,
+        group: Option<String>,
     },
 }
 
@@ -2042,8 +2046,8 @@ async fn main() -> ExitCode {
             cmd: CollectionsCmd::Ls { group },
         } => cmds::collections::ls(&group, mode).await,
         Cmd::Suppress {
-            cmd: SuppressCmd::Ls { app },
-        } => cmds::suppress::ls(&app, mode).await,
+            cmd: SuppressCmd::Ls { app, group },
+        } => cmds::suppress::ls(app.as_deref(), group.as_deref(), mode).await,
         Cmd::Files {
             cmd:
                 FilesCmd::Ls {