feat(suppress): group-suppress warnings + ls + journey + docs (M1.5)

- dangling_suppress_warnings takes an ApplyOwner and walks the group's own
  chain (GROUP_CHAIN_LEVELS_CTE) for a group node; runs for both owners.
- GET /groups/{id}/suppressions + `pic suppress ls --group` (client + cmd +
  main.rs; --app/--group mutually exclusive).
- suppress journey: a child group declines a parent template for its subtree;
  suppress ls --group shows the marker. Docs §4.5 + CLAUDE.md move group-level
  suppression from Deferred to implemented.

Completes M1. (An unrelated pre-existing email_inbound dispatch-timing flake
passes in isolation.)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/main.rs

@@ -587,10 +587,14 @@ enum CollectionsCmd {
 
 #[derive(Subcommand)]
 enum SuppressCmd {
-    /// List the inherited templates an app declines (§11 tail). App-only.
+    /// List the inherited templates an owner declines (§11 tail). Exactly one
+    /// of `--app` (declines for itself) or `--group` (declines for its whole
+    /// subtree, §11 tail M1).
     Ls {
+        #[arg(long, conflicts_with = "group")]
+        app: Option<String>,
         #[arg(long)]
-        app: String,
+        group: Option<String>,
     },
 }
 
@@ -2042,8 +2046,8 @@ async fn main() -> ExitCode {
             cmd: CollectionsCmd::Ls { group },
         } => cmds::collections::ls(&group, mode).await,
         Cmd::Suppress {
-            cmd: SuppressCmd::Ls { app },
-        } => cmds::suppress::ls(&app, mode).await,
+            cmd: SuppressCmd::Ls { app, group },
+        } => cmds::suppress::ls(app.as_deref(), group.as_deref(), mode).await,
         Cmd::Files {
             cmd:
                 FilesCmd::Ls {