feat(group-blobs): pic kv ls/get --group + journey + docs (M4.3+M4.4)

- `pic kv ls --group` / `pic kv get --group` (mutually exclusive with --app)
  hit the M4 admin API; client group_kv_list/group_kv_get.
- collections journey: a script writes a shared KV value, the operator lists +
  fetches it via the admin API with no script.
- docs: §11.6 + CLAUDE.md record M3 quotas + M4 read-only admin API.

Completes M4.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/client.rs

@@ -1141,6 +1141,39 @@ impl Client {
         Ok(wrapped.value)
     }
 
+    /// §11.6 M4: a group's shared-KV collection.
+    /// `GET /api/v1/admin/groups/{id_or_slug}/kv?collection=…`
+    pub async fn group_kv_list(
+        &self,
+        group: &str,
+        collection: &str,
+        limit: u32,
+    ) -> Result<KvListPageDto> {
+        let (group, collection) = (seg(group), seg(collection));
+        let resp = self
+            .request(
+                Method::GET,
+                &format!("/api/v1/admin/groups/{group}/kv?collection={collection}&limit={limit}"),
+            )
+            .send()
+            .await?;
+        decode(resp).await
+    }
+
+    /// `GET /api/v1/admin/groups/{id_or_slug}/kv/{collection}/{key}`
+    pub async fn group_kv_get(&self, group: &str, collection: &str, key: &str) -> Result<Value> {
+        let (group, collection, key) = (seg(group), seg(collection), seg(key));
+        let resp = self
+            .request(
+                Method::GET,
+                &format!("/api/v1/admin/groups/{group}/kv/{collection}/{key}"),
+            )
+            .send()
+            .await?;
+        let wrapped: KvGetResponse = decode(resp).await?;
+        Ok(wrapped.value)
+    }
+
     // --- Queues (G2, read-only admin surface) -----------------------------
 
     /// `GET /api/v1/admin/apps/{id_or_slug}/queues`