feat(group-blobs): pic kv ls/get --group + journey + docs (M4.3+M4.4)

- `pic kv ls --group` / `pic kv get --group` (mutually exclusive with --app)
  hit the M4 admin API; client group_kv_list/group_kv_get.
- collections journey: a script writes a shared KV value, the operator lists +
  fetches it via the admin API with no script.
- docs: §11.6 + CLAUDE.md record M3 quotas + M4 read-only admin API.

Completes M4.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/main.rs

@@ -315,19 +315,24 @@ struct ConfigArgs {
 
 #[derive(Subcommand)]
 enum KvCmd {
-    /// List keys in a collection.
+    /// List keys in a collection. Exactly one of `--app` (per-app KV) or
+    /// `--group` (a group's §11.6 shared KV).
     Ls {
+        #[arg(long, conflicts_with = "group")]
+        app: Option<String>,
         #[arg(long)]
-        app: String,
+        group: Option<String>,
         #[arg(long)]
         collection: String,
         #[arg(long, default_value_t = 100)]
         limit: u32,
     },
-    /// Fetch one key's value (printed as JSON).
+    /// Fetch one key's value (printed as JSON). `--app` or `--group`.
     Get {
+        #[arg(long, conflicts_with = "group")]
+        app: Option<String>,
         #[arg(long)]
-        app: String,
+        group: Option<String>,
         #[arg(long)]
         collection: String,
         key: String,
@@ -2083,18 +2088,20 @@ async fn main() -> ExitCode {
             cmd:
                 KvCmd::Ls {
                     app,
+                    group,
                     collection,
                     limit,
                 },
-        } => cmds::kv::ls(&app, &collection, limit, mode).await,
+        } => cmds::kv::ls(app.as_deref(), group.as_deref(), &collection, limit, mode).await,
         Cmd::Kv {
             cmd:
                 KvCmd::Get {
                     app,
+                    group,
                     collection,
                     key,
                 },
-        } => cmds::kv::get(&app, &collection, &key).await,
+        } => cmds::kv::get(app.as_deref(), group.as_deref(), &collection, &key).await,
     };
 
     match result {