feat(suppress): group-suppress warnings + ls + journey + docs (M1.5)

- dangling_suppress_warnings takes an ApplyOwner and walks the group's own
  chain (GROUP_CHAIN_LEVELS_CTE) for a group node; runs for both owners.
- GET /groups/{id}/suppressions + `pic suppress ls --group` (client + cmd +
  main.rs; --app/--group mutually exclusive).
- suppress journey: a child group declines a parent template for its subtree;
  suppress ls --group shows the marker. Docs §4.5 + CLAUDE.md move group-level
  suppression from Deferred to implemented.

Completes M1. (An unrelated pre-existing email_inbound dispatch-timing flake
passes in isolation.)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/design/groups-and-project-tool.md

@@ -457,7 +457,18 @@ Two distinct constraints:
 > row, like any definitional change). A suppression that matches only sealed templates is an apply-time
 > **warning** ("… is sealed — the suppression has no effect"); `pic triggers/routes ls --group` show a
 > `sealed` column. Pinned by `manager-core/tests/sealed_templates.rs` + the `sealed` journey.
-> **Deferred:** group-level suppression (decline an ancestor's template for a whole subtree).
+>
+> **Group-level suppression (✅, M1).** `template_suppressions` gained a polymorphic owner
+> (`0060_group_suppressions.sql`, mirroring the triggers/routes reshape): a `[group]` may now declare
+> `[suppress]` to decline a template it inherits from a **higher ancestor**, for its **whole subtree**.
+> The two consumption filters generalized to the chain: the trigger anti-join joins the `chain` CTE
+> (`ts.app_id = sc.app_owner OR ts.group_id = sc.group_owner`) so a suppression owned by the firing app OR
+> any ancestor group applies; `list_route_suppressions` expands group-owned suppressions across
+> descendants via the all-apps `app_chain` CTE, so `compile_effective_routes` is unchanged. Still
+> inheritance-only (`t.group_id IS NOT NULL` / `depth > 0`) and `sealed` still overrides. Read-only
+> `pic suppress ls --group`; the dangling/ineffective warning walks the group's own chain
+> (`GROUP_CHAIN_LEVELS_CTE`). Pinned by `manager-core/tests/group_suppression.rs` + the `suppress`
+> journey. **Deferred:** none for suppression.
 
 ### 4.6 Secrets & `pull`