feat(cli): nested-manifest discovery + pic plan/apply --dir tree mode (Phase 5 C4)

Phase 5 C4. `pic plan --dir <root>` / `pic apply --dir <root>` discover every
`picloud.toml` under a directory (groups + apps), assemble the wire tree
bundle, and drive the C3 `/tree/{plan,apply}` endpoints — a whole project
subtree reconciled and reviewed as one unit.

  * New `discover` module: recursive walk (skips `.picloud`/`.git`/`scripts`/
    `target`), one node per manifest, app/group inferred from the manifest;
    rejects a duplicate (kind, slug). On-disk nesting is organizational — the
    server resolves ancestry from its own group tree.
  * `client`: `plan_tree`/`apply_tree` + `TreePlanDto`/`NodePlanDto`. `pic plan
    --dir` renders a per-node diff table and records ONE tree bound-token under
    a `<tree>` linkstate marker; `pic apply --dir` replays it (force/`--yes`/
    prune apply tree-wide). `--dir` conflicts with `--file`.

Live-validated: a nested tree (root group dir + nested app dir, app route bound
to the group's inherited script) → `pic plan --dir .` shows both nodes' changes
→ `pic apply --dir .` applies all in one tx → re-plan all-noop.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/cmds/apply.rs

@@ -92,6 +92,73 @@ pub async fn run(
     Ok(())
 }
 
+/// `pic apply --dir <root>` (Phase 5): reconcile a whole project tree — every
+/// `picloud.toml` under `root` — in ONE atomic server transaction.
+pub async fn run_tree(
+    dir: &Path,
+    prune: bool,
+    yes: bool,
+    force: bool,
+    env: Option<&str>,
+    mode: OutputMode,
+) -> Result<()> {
+    let creds = config::resolve()?;
+    let client = Client::from_creds(&creds)?;
+    let (bundle, node_count) = crate::discover::build_tree(dir, env)?;
+
+    if prune && !yes {
+        confirm_prune(&format!("{node_count} node(s) under {}", dir.display()))?;
+    }
+
+    let token_key = crate::cmds::plan::TREE_TOKEN_KEY;
+    let expected_token = if force {
+        None
+    } else {
+        crate::linkstate::read_plan(dir)
+            .filter(|l| l.app == token_key)
+            .map(|l| l.state_token)
+    };
+
+    let report = client
+        .apply_tree(&bundle, prune, expected_token.as_deref())
+        .await?;
+    crate::linkstate::clear_plan(dir, token_key);
+
+    let mut block = KvBlock::new();
+    block
+        .field("nodes", node_count.to_string())
+        .field(
+            "scripts",
+            format!(
+                "+{} ~{} -{}",
+                report.scripts_created, report.scripts_updated, report.scripts_deleted
+            ),
+        )
+        .field(
+            "routes",
+            format!(
+                "+{} ~{} -{}",
+                report.routes_created, report.routes_updated, report.routes_deleted
+            ),
+        )
+        .field(
+            "triggers",
+            format!("+{} -{}", report.triggers_created, report.triggers_deleted),
+        )
+        .field(
+            "vars",
+            format!(
+                "+{} ~{} -{}",
+                report.vars_created, report.vars_updated, report.vars_deleted
+            ),
+        );
+    for w in &report.warnings {
+        block.field("warning", w.clone());
+    }
+    block.print(mode);
+    Ok(())
+}
+
 /// `--prune` deletes live scripts/routes/triggers absent from the manifest —
 /// irreversible. Require an explicit go-ahead: an interactive `y`, or `--yes`
 /// for non-interactive/CI use. Refuse a non-interactive prune without `--yes`

crates/picloud-cli/src/cmds/plan.rs

@@ -9,11 +9,15 @@ use anyhow::{Context, Result};
 use serde::Serialize;
 use serde_json::{json, Map, Value};
 
-use crate::client::{ChangeDto, Client, NodeKind, PlanDto};
+use crate::client::{ChangeDto, Client, NodeKind, PlanDto, TreePlanDto};
 use crate::config;
 use crate::manifest::Manifest;
 use crate::output::{OutputMode, Table};
 
+/// Linkstate key for a whole-tree bound plan (Phase 5) — a tree has no single
+/// slug, so its token is stored under this reserved marker.
+pub const TREE_TOKEN_KEY: &str = "<tree>";
+
 pub async fn run(manifest_path: &Path, env: Option<&str>, mode: OutputMode) -> Result<()> {
     let creds = config::resolve()?;
     let client = Client::from_creds(&creds)?;
@@ -40,6 +44,48 @@ pub async fn run(manifest_path: &Path, env: Option<&str>, mode: OutputMode) -> R
     Ok(())
 }
 
+/// `pic plan --dir <root>` (Phase 5): diff a whole project tree — every
+/// `picloud.toml` under `root` — against the live group/app subtree.
+pub async fn run_tree(dir: &Path, env: Option<&str>, mode: OutputMode) -> Result<()> {
+    let creds = config::resolve()?;
+    let client = Client::from_creds(&creds)?;
+    let (bundle, _count) = crate::discover::build_tree(dir, env)?;
+    let plan = client.plan_tree(&bundle).await?;
+    if !plan.state_token.is_empty() {
+        if let Err(e) = crate::linkstate::write_plan(dir, TREE_TOKEN_KEY, &plan.state_token) {
+            eprintln!("warning: could not record plan state for `pic apply`: {e}");
+        }
+    }
+    render_tree(&plan, mode);
+    Ok(())
+}
+
+fn render_tree(plan: &TreePlanDto, mode: OutputMode) {
+    let mut table = Table::new(["node", "kind", "op", "resource", "detail"]);
+    for n in &plan.nodes {
+        let node = format!("{}:{}", n.kind, n.slug);
+        let groups: [(&str, &Vec<ChangeDto>); 5] = [
+            ("script", &n.scripts),
+            ("route", &n.routes),
+            ("trigger", &n.triggers),
+            ("secret", &n.secrets),
+            ("var", &n.vars),
+        ];
+        for (rk, changes) in groups {
+            for c in changes {
+                table.row([
+                    node.clone(),
+                    rk.to_string(),
+                    c.op.clone(),
+                    c.key.clone(),
+                    c.detail.clone().unwrap_or_default(),
+                ]);
+            }
+        }
+    }
+    table.print(mode);
+}
+
 /// Assemble the wire bundle: scripts carry inlined source (read from
 /// their `file`), routes pass through, triggers flatten into a tagged
 /// array, secrets are names only.