feat(suppress): author + persist per-app template suppressions (§11 tail S2)

The declarative half — a `[suppress]` block persists as markers; no runtime
effect yet (S3 consumes them).

- manifest: `[suppress]` table on an app with `triggers = [...]` (handler
  script names) + `routes = [...]` (paths), `deny_unknown_fields`; rejected
  on a `[group]` (a group just wouldn't declare the template).
- suppression_repo.rs: app-keyed `list_for_app` / `insert` / `delete_tx`
  over `(app_id, target_kind, reference)`, mirroring extension_point_repo
  minus the owner polymorphism.
- apply_service: the extension-point marker-reconcile pattern —
  `Bundle.suppress_triggers/_routes`, `Plan.suppressions`,
  `CurrentState.suppressions`, `load_current(App)` load, `diff_suppressions`
  (key `"{kind}:{reference}"`, split on the first `:` so a route param path
  survives), create + prune reconcile blocks, `validate_bundle_for` group
  reject, `ApplyReport` counters.
- CLI: `build_bundle` carries the two vecs; `pic plan` + apply report gain a
  suppressions row (DTOs + display).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/src/suppression_repo.rs

@@ -0,0 +1,75 @@
+//! Template-suppression markers (§11 tail) — the `template_suppressions` table
+//! (0058). A marker `(app_id, target_kind, reference)` records that an app opts
+//! OUT of an inherited group template: a handler script name it declines
+//! (`target_kind='trigger'`) or a path it declines (`target_kind='route'`).
+//!
+//! App-only (a group would just not declare the template), so — unlike the
+//! owner-polymorphic `extension_points` — these free functions take a plain
+//! `AppId`. Same tx-function style: read over `&PgPool`, write over a
+//! `&mut Transaction`.
+
+use picloud_shared::AppId;
+use sqlx::{PgPool, Postgres, Transaction};
+
+/// The two suppressible template kinds, as stored in `target_kind`.
+pub const TARGET_TRIGGER: &str = "trigger";
+pub const TARGET_ROUTE: &str = "route";
+
+/// List the suppression markers declared at `app_id`, as `(target_kind,
+/// reference)` pairs, stably ordered. Backs `load_current` (the apply diff) and
+/// the read-only `suppress ls`.
+pub async fn list_for_app(
+    pool: &PgPool,
+    app_id: AppId,
+) -> Result<Vec<(String, String)>, sqlx::Error> {
+    let rows: Vec<(String, String)> = sqlx::query_as(
+        "SELECT target_kind, reference FROM template_suppressions \
+         WHERE app_id = $1 ORDER BY target_kind, LOWER(reference)",
+    )
+    .bind(app_id.into_inner())
+    .fetch_all(pool)
+    .await?;
+    Ok(rows)
+}
+
+/// Insert a suppression marker in the apply transaction. Idempotent: re-apply
+/// of an already-declared `(kind, reference)` is a no-op (`ON CONFLICT DO
+/// NOTHING`), so the marker survives without a spurious version bump.
+pub async fn insert_suppression_tx(
+    tx: &mut Transaction<'_, Postgres>,
+    app_id: AppId,
+    target_kind: &str,
+    reference: &str,
+) -> Result<(), sqlx::Error> {
+    sqlx::query(
+        "INSERT INTO template_suppressions (app_id, target_kind, reference) \
+         VALUES ($1, $2, $3) \
+         ON CONFLICT (app_id, target_kind, reference) DO NOTHING",
+    )
+    .bind(app_id.into_inner())
+    .bind(target_kind)
+    .bind(reference)
+    .execute(&mut **tx)
+    .await?;
+    Ok(())
+}
+
+/// Delete a suppression marker in the apply transaction. Used by `--prune` when
+/// the manifest stops declaring the reference → the template re-inherits.
+pub async fn delete_suppression_tx(
+    tx: &mut Transaction<'_, Postgres>,
+    app_id: AppId,
+    target_kind: &str,
+    reference: &str,
+) -> Result<(), sqlx::Error> {
+    sqlx::query(
+        "DELETE FROM template_suppressions \
+         WHERE app_id = $1 AND target_kind = $2 AND reference = $3",
+    )
+    .bind(app_id.into_inner())
+    .bind(target_kind)
+    .bind(reference)
+    .execute(&mut **tx)
+    .await?;
+    Ok(())
+}