feat(cli): declare app vars in the manifest + plan/apply them

Adds a `[vars]` block to `picloud.toml` (key → TOML value), reconciled by
`pic plan`/`pic apply` alongside scripts/routes/triggers/secrets. Unlike
`[secrets]` (name-only), var values live inline since they aren't secret.
The overlay (`picloud.<env>.toml`) may carry `[vars]`; overlay keys win
per key (the env-specific value of an env-agnostic default).

`build_bundle` serializes the vars to JSON for the wire (TOML round-trips
via serde); `pic plan` shows a `var` row group and `pic apply` reports
`vars +c ~u -d`. The `PlanDto`/`ApplyReportDto` gain the matching fields.
`pic pull` carries an empty `[vars]` for now (export lands next). Adds a
round-trip + overlay-precedence unit test.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/cmds/apply.rs

@@ -75,6 +75,13 @@ pub async fn run(
         .field(
             "triggers",
             format!("+{} -{}", report.triggers_created, report.triggers_deleted),
+        )
+        .field(
+            "vars",
+            format!(
+                "+{} ~{} -{}",
+                report.vars_created, report.vars_updated, report.vars_deleted
+            ),
         );
     for w in &report.warnings {
         block.field("warning", w.clone());