feat(suppress): author + persist per-app template suppressions (§11 tail S2)

The declarative half — a `[suppress]` block persists as markers; no runtime
effect yet (S3 consumes them).

- manifest: `[suppress]` table on an app with `triggers = [...]` (handler
  script names) + `routes = [...]` (paths), `deny_unknown_fields`; rejected
  on a `[group]` (a group just wouldn't declare the template).
- suppression_repo.rs: app-keyed `list_for_app` / `insert` / `delete_tx`
  over `(app_id, target_kind, reference)`, mirroring extension_point_repo
  minus the owner polymorphism.
- apply_service: the extension-point marker-reconcile pattern —
  `Bundle.suppress_triggers/_routes`, `Plan.suppressions`,
  `CurrentState.suppressions`, `load_current(App)` load, `diff_suppressions`
  (key `"{kind}:{reference}"`, split on the first `:` so a route param path
  survives), create + prune reconcile blocks, `validate_bundle_for` group
  reject, `ApplyReport` counters.
- CLI: `build_bundle` carries the two vecs; `pic plan` + apply report gain a
  suppressions row (DTOs + display).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/cmds/apply.rs

@@ -98,6 +98,13 @@ pub async fn run(
                 "+{} -{}",
                 report.collections_created, report.collections_deleted
             ),
+        )
+        .field(
+            "suppressions",
+            format!(
+                "+{} -{}",
+                report.suppressions_created, report.suppressions_deleted
+            ),
         );
     for w in &report.warnings {
         block.field("warning", w.clone());
@@ -179,6 +186,13 @@ pub async fn run_tree(
                 "+{} -{}",
                 report.collections_created, report.collections_deleted
             ),
+        )
+        .field(
+            "suppressions",
+            format!(
+                "+{} -{}",
+                report.suppressions_created, report.suppressions_deleted
+            ),
         );
     for w in &report.warnings {
         block.field("warning", w.clone());

crates/picloud-cli/src/cmds/init.rs

@@ -140,6 +140,7 @@ fn scaffold_manifest(slug: &str, name: &str) -> Manifest {
         triggers: crate::manifest::ManifestTriggers::default(),
         secrets: crate::manifest::ManifestSecrets::default(),
         vars: std::collections::BTreeMap::new(),
+        suppress: crate::manifest::ManifestSuppress::default(),
     }
 }
 

crates/picloud-cli/src/cmds/plan.rs

@@ -64,7 +64,7 @@ fn render_tree(plan: &TreePlanDto, mode: OutputMode) {
     let mut table = Table::new(["node", "kind", "op", "resource", "detail"]);
     for n in &plan.nodes {
         let node = format!("{}:{}", n.kind, n.slug);
-        let groups: [(&str, &Vec<ChangeDto>); 7] = [
+        let groups: [(&str, &Vec<ChangeDto>); 8] = [
             ("script", &n.scripts),
             ("route", &n.routes),
             ("trigger", &n.triggers),
@@ -72,6 +72,7 @@ fn render_tree(plan: &TreePlanDto, mode: OutputMode) {
             ("var", &n.vars),
             ("extension_point", &n.extension_points),
             ("collection", &n.collections),
+            ("suppression", &n.suppressions),
         ];
         for (rk, changes) in groups {
             for c in changes {
@@ -168,6 +169,8 @@ pub fn build_bundle(manifest: &Manifest, base_dir: &Path) -> Result<Value> {
             .into_iter()
             .map(|(name, kind)| json!({ "name": name, "kind": kind }))
             .collect::<Vec<_>>(),
+        "suppress_triggers": manifest.suppress.triggers,
+        "suppress_routes": manifest.suppress.routes,
     }))
 }
 
@@ -182,7 +185,7 @@ fn tagged(kind: &str, spec: impl Serialize) -> Result<Value> {
 
 fn render(plan: &PlanDto, mode: OutputMode) {
     let mut table = Table::new(["kind", "op", "resource", "detail"]);
-    let groups: [(&str, &Vec<ChangeDto>); 7] = [
+    let groups: [(&str, &Vec<ChangeDto>); 8] = [
         ("script", &plan.scripts),
         ("route", &plan.routes),
         ("trigger", &plan.triggers),
@@ -190,6 +193,7 @@ fn render(plan: &PlanDto, mode: OutputMode) {
         ("var", &plan.vars),
         ("extension_point", &plan.extension_points),
         ("collection", &plan.collections),
+        ("suppression", &plan.suppressions),
     ];
     for (kind, changes) in groups {
         for c in changes {

crates/picloud-cli/src/cmds/pull.rs

@@ -234,6 +234,7 @@ pub async fn run(app_ident: &str, dir: &Path, force: bool, mode: OutputMode) ->
             names: secrets.iter().map(|s| s.name.clone()).collect(),
         },
         vars: manifest_vars,
+        suppress: crate::manifest::ManifestSuppress::default(),
     };
 
     std::fs::write(&manifest_path, manifest.to_toml()?)