feat(cli): nested-manifest discovery + pic plan/apply --dir tree mode (Phase 5 C4)

Phase 5 C4. `pic plan --dir <root>` / `pic apply --dir <root>` discover every
`picloud.toml` under a directory (groups + apps), assemble the wire tree
bundle, and drive the C3 `/tree/{plan,apply}` endpoints — a whole project
subtree reconciled and reviewed as one unit.

  * New `discover` module: recursive walk (skips `.picloud`/`.git`/`scripts`/
    `target`), one node per manifest, app/group inferred from the manifest;
    rejects a duplicate (kind, slug). On-disk nesting is organizational — the
    server resolves ancestry from its own group tree.
  * `client`: `plan_tree`/`apply_tree` + `TreePlanDto`/`NodePlanDto`. `pic plan
    --dir` renders a per-node diff table and records ONE tree bound-token under
    a `<tree>` linkstate marker; `pic apply --dir` replays it (force/`--yes`/
    prune apply tree-wide). `--dir` conflicts with `--file`.

Live-validated: a nested tree (root group dir + nested app dir, app route bound
to the group's inherited script) → `pic plan --dir .` shows both nodes' changes
→ `pic apply --dir .` applies all in one tx → re-plan all-noop.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/client.rs

@@ -1227,6 +1227,45 @@ impl Client {
         }
         decode(resp).await
     }
+
+    /// `POST /api/v1/admin/tree/plan` — diff a whole project tree (Phase 5).
+    pub async fn plan_tree(&self, bundle: &serde_json::Value) -> Result<TreePlanDto> {
+        let resp = self
+            .request(Method::POST, "/api/v1/admin/tree/plan")
+            .json(bundle)
+            .send()
+            .await?;
+        decode(resp).await
+    }
+
+    /// `POST /api/v1/admin/tree/apply` — reconcile a whole project tree in one
+    /// transaction (Phase 5).
+    pub async fn apply_tree(
+        &self,
+        bundle: &serde_json::Value,
+        prune: bool,
+        expected_token: Option<&str>,
+    ) -> Result<ApplyReportDto> {
+        let body = serde_json::json!({
+            "bundle": bundle,
+            "prune": prune,
+            "expected_token": expected_token,
+        });
+        let resp = self
+            .request(Method::POST, "/api/v1/admin/tree/apply")
+            .json(&body)
+            .send()
+            .await?;
+        if resp.status() == reqwest::StatusCode::CONFLICT {
+            let body = resp.text().await.unwrap_or_default();
+            let msg = parse_error_body(&body).unwrap_or(body);
+            return Err(anyhow!(
+                "{msg}\nThe project tree changed since your last `pic plan`. Re-run \
+                 `pic plan --dir` to review, then `pic apply --dir` — or add `--force`."
+            ));
+        }
+        decode(resp).await
+    }
 }
 
 /// `POST /api/v1/admin/auth/login` — sits outside the `Client` because
@@ -1295,6 +1334,32 @@ pub struct ChangeDto {
     pub detail: Option<String>,
 }
 
+/// Response of `POST .../tree/plan` (Phase 5): a per-node diff + one combined
+/// bound-plan token for the whole subtree.
+#[derive(Debug, Deserialize)]
+pub struct TreePlanDto {
+    #[serde(default)]
+    pub nodes: Vec<NodePlanDto>,
+    #[serde(default)]
+    pub state_token: String,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct NodePlanDto {
+    pub kind: String,
+    pub slug: String,
+    #[serde(default)]
+    pub scripts: Vec<ChangeDto>,
+    #[serde(default)]
+    pub routes: Vec<ChangeDto>,
+    #[serde(default)]
+    pub triggers: Vec<ChangeDto>,
+    #[serde(default)]
+    pub secrets: Vec<ChangeDto>,
+    #[serde(default)]
+    pub vars: Vec<ChangeDto>,
+}
+
 /// Response of `POST .../apply`: counts of what changed.
 #[derive(Debug, Default, Deserialize)]
 pub struct ApplyReportDto {