feat(suppress): author + persist per-app template suppressions (§11 tail S2)

The declarative half — a `[suppress]` block persists as markers; no runtime
effect yet (S3 consumes them).

- manifest: `[suppress]` table on an app with `triggers = [...]` (handler
  script names) + `routes = [...]` (paths), `deny_unknown_fields`; rejected
  on a `[group]` (a group just wouldn't declare the template).
- suppression_repo.rs: app-keyed `list_for_app` / `insert` / `delete_tx`
  over `(app_id, target_kind, reference)`, mirroring extension_point_repo
  minus the owner polymorphism.
- apply_service: the extension-point marker-reconcile pattern —
  `Bundle.suppress_triggers/_routes`, `Plan.suppressions`,
  `CurrentState.suppressions`, `load_current(App)` load, `diff_suppressions`
  (key `"{kind}:{reference}"`, split on the first `:` so a route param path
  survives), create + prune reconcile blocks, `validate_bundle_for` group
  reject, `ApplyReport` counters.
- CLI: `build_bundle` carries the two vecs; `pic plan` + apply report gain a
  suppressions row (DTOs + display).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/client.rs

@@ -1429,6 +1429,8 @@ pub struct PlanDto {
     pub extension_points: Vec<ChangeDto>,
     #[serde(default)]
     pub collections: Vec<ChangeDto>,
+    #[serde(default)]
+    pub suppressions: Vec<ChangeDto>,
     /// Fingerprint of the live state this plan was computed against; carried
     /// in `.picloud/` and replayed to `apply` for the bound-plan check.
     #[serde(default)]
@@ -1471,6 +1473,8 @@ pub struct NodePlanDto {
     pub extension_points: Vec<ChangeDto>,
     #[serde(default)]
     pub collections: Vec<ChangeDto>,
+    #[serde(default)]
+    pub suppressions: Vec<ChangeDto>,
 }
 
 /// Response of `POST .../apply`: counts of what changed.
@@ -1507,6 +1511,10 @@ pub struct ApplyReportDto {
     #[serde(default)]
     pub collections_deleted: u32,
     #[serde(default)]
+    pub suppressions_created: u32,
+    #[serde(default)]
+    pub suppressions_deleted: u32,
+    #[serde(default)]
     pub warnings: Vec<String>,
 }