feat(cli): nested-manifest discovery + pic plan/apply --dir tree mode (Phase 5 C4)

Phase 5 C4. `pic plan --dir <root>` / `pic apply --dir <root>` discover every
`picloud.toml` under a directory (groups + apps), assemble the wire tree
bundle, and drive the C3 `/tree/{plan,apply}` endpoints — a whole project
subtree reconciled and reviewed as one unit.

  * New `discover` module: recursive walk (skips `.picloud`/`.git`/`scripts`/
    `target`), one node per manifest, app/group inferred from the manifest;
    rejects a duplicate (kind, slug). On-disk nesting is organizational — the
    server resolves ancestry from its own group tree.
  * `client`: `plan_tree`/`apply_tree` + `TreePlanDto`/`NodePlanDto`. `pic plan
    --dir` renders a per-node diff table and records ONE tree bound-token under
    a `<tree>` linkstate marker; `pic apply --dir` replays it (force/`--yes`/
    prune apply tree-wide). `--dir` conflicts with `--file`.

Live-validated: a nested tree (root group dir + nested app dir, app route bound
to the group's inherited script) → `pic plan --dir .` shows both nodes' changes
→ `pic apply --dir .` applies all in one tx → re-plan all-noop.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/cmds/plan.rs

@@ -9,11 +9,15 @@ use anyhow::{Context, Result};
 use serde::Serialize;
 use serde_json::{json, Map, Value};
 
-use crate::client::{ChangeDto, Client, NodeKind, PlanDto};
+use crate::client::{ChangeDto, Client, NodeKind, PlanDto, TreePlanDto};
 use crate::config;
 use crate::manifest::Manifest;
 use crate::output::{OutputMode, Table};
 
+/// Linkstate key for a whole-tree bound plan (Phase 5) — a tree has no single
+/// slug, so its token is stored under this reserved marker.
+pub const TREE_TOKEN_KEY: &str = "<tree>";
+
 pub async fn run(manifest_path: &Path, env: Option<&str>, mode: OutputMode) -> Result<()> {
     let creds = config::resolve()?;
     let client = Client::from_creds(&creds)?;
@@ -40,6 +44,48 @@ pub async fn run(manifest_path: &Path, env: Option<&str>, mode: OutputMode) -> R
     Ok(())
 }
 
+/// `pic plan --dir <root>` (Phase 5): diff a whole project tree — every
+/// `picloud.toml` under `root` — against the live group/app subtree.
+pub async fn run_tree(dir: &Path, env: Option<&str>, mode: OutputMode) -> Result<()> {
+    let creds = config::resolve()?;
+    let client = Client::from_creds(&creds)?;
+    let (bundle, _count) = crate::discover::build_tree(dir, env)?;
+    let plan = client.plan_tree(&bundle).await?;
+    if !plan.state_token.is_empty() {
+        if let Err(e) = crate::linkstate::write_plan(dir, TREE_TOKEN_KEY, &plan.state_token) {
+            eprintln!("warning: could not record plan state for `pic apply`: {e}");
+        }
+    }
+    render_tree(&plan, mode);
+    Ok(())
+}
+
+fn render_tree(plan: &TreePlanDto, mode: OutputMode) {
+    let mut table = Table::new(["node", "kind", "op", "resource", "detail"]);
+    for n in &plan.nodes {
+        let node = format!("{}:{}", n.kind, n.slug);
+        let groups: [(&str, &Vec<ChangeDto>); 5] = [
+            ("script", &n.scripts),
+            ("route", &n.routes),
+            ("trigger", &n.triggers),
+            ("secret", &n.secrets),
+            ("var", &n.vars),
+        ];
+        for (rk, changes) in groups {
+            for c in changes {
+                table.row([
+                    node.clone(),
+                    rk.to_string(),
+                    c.op.clone(),
+                    c.key.clone(),
+                    c.detail.clone().unwrap_or_default(),
+                ]);
+            }
+        }
+    }
+    table.print(mode);
+}
+
 /// Assemble the wire bundle: scripts carry inlined source (read from
 /// their `file`), routes pass through, triggers flatten into a tagged
 /// array, secrets are names only.