feat: declarative project-tool foundation (pull/plan/apply/prune)

Add a server-side, atomic, declarative reconcile loop for a single app —
the foundation of the project-tool design. Developers describe an app's
scripts, routes, triggers, and secret-names in `picloud.toml`, then
`pic pull / plan / apply [--prune]` to converge live state to the manifest.

Server (manager-core):
- apply_service: a pure diff engine (compute_diff) shared by plan and
  apply, plus an ApplyService that composes the existing per-repo writes
  into ONE Postgres transaction. Identity keys mirror the DB UNIQUE
  constraints (script=lower(name); route=(method,host_kind,host,
  path_kind,path); trigger=per-kind semantic tuple; secret=name).
  Apply takes a per-app advisory lock, recomputes the diff in-tx, applies
  scripts -> routes -> triggers, prunes dependents-first, commits, then
  refreshes the route table once post-commit.
- apply_api: POST /apps/{id}/plan (AppRead) and /apps/{id}/apply.
  Apply requires the per-kind write caps the bundle exercises (all three
  when --prune), plus AppSecretsRead when it binds an email trigger.
- tx-accepting repo siblings (insert/update/delete *_tx) so the existing
  create/update/delete delegate to one SQL definition each.
- email triggers reference an inbound secret by NAME; the value is
  resolved, decrypted (AAD-bound), and re-sealed server-side at apply —
  it never travels in the manifest.

CLI (picloud-cli):
- manifest.rs (picloud.toml model), client plan/apply, and the pull/plan/
  apply commands. pull rejects filesystem-unsafe script names up front.

Safety properties enforced and tested:
- idempotent: a freshly-pulled manifest re-applies as all-NoOp.
- atomic: a mid-bundle failure rolls back with nothing written.
- routes delete-before-insert so a freed binding is reusable in one apply.
- queue one-consumer invariant held inside the shared tx.
- email triggers are never pruned, and a script that still owns an
  email/dead-letter trigger can't be pruned (the FK cascade would destroy
  the sealed secret) — refused with a pointer to `pic triggers rm`.
- plan and apply agree on unset email-secret references.

No migration: the existing schema's UNIQUE constraints serve as identity
keys. Groups, env-scoping, and the `enabled` toggle are later milestones.

Tested: manager-core lib (360) + CLI bins (27) + 8 project-tool journeys
(pull/plan/apply/prune/email+queue), all green; clippy -D warnings clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

crates/picloud-cli/tests/pull.rs

@@ -0,0 +1,91 @@
+//! `pic pull` journey: stand up an app with a script, route, cron trigger,
+//! and a secret, then export it and assert the manifest + script file.
+
+use tempfile::TempDir;
+
+use crate::common;
+
+#[ignore = "needs DATABASE_URL pointing at a running Postgres"]
+#[test]
+fn pull_exports_manifest_and_sources() {
+    let Some(fx) = common::fixture_or_skip() else {
+        return;
+    };
+    let env = common::admin_env(fx);
+
+    // App + script "hello" (deploy derives the name from the file stem).
+    let (script_id, guard) = common::deploy_fixture(&env, "pull", "hello.rhai");
+    let app = guard.slug().to_string();
+
+    // Route → script.
+    common::pic_as(&env)
+        .args([
+            "routes", "create", "--script", &script_id, "--path", "/hook", "--method", "POST",
+        ])
+        .assert()
+        .success();
+
+    // Cron trigger → script.
+    common::pic_as(&env)
+        .args([
+            "triggers",
+            "create-cron",
+            "--app",
+            &app,
+            "--script",
+            &script_id,
+            "--schedule",
+            "0 0 * * * *",
+        ])
+        .assert()
+        .success();
+
+    // Secret (name only ends up in the manifest; value stays server-side).
+    common::pic_as(&env)
+        .args(["secrets", "set", "--app", &app, "api_key"])
+        .write_stdin("xyzzy")
+        .assert()
+        .success();
+
+    // Pull into a scratch dir.
+    let out_dir = TempDir::new().expect("pull tempdir");
+    common::pic_as(&env)
+        .args(["pull", &app, "--dir"])
+        .arg(out_dir.path())
+        .assert()
+        .success();
+
+    // Manifest exists and captures every resource.
+    let manifest = std::fs::read_to_string(out_dir.path().join("picloud.toml"))
+        .expect("picloud.toml should be written");
+    assert!(
+        manifest.contains(&format!("slug = \"{app}\"")),
+        "manifest missing app slug:\n{manifest}"
+    );
+    assert!(
+        manifest.contains("name = \"hello\"") && manifest.contains("scripts/hello.rhai"),
+        "manifest missing script entry:\n{manifest}"
+    );
+    assert!(
+        manifest.contains("[[routes]]") && manifest.contains("path = \"/hook\""),
+        "manifest missing route:\n{manifest}"
+    );
+    assert!(
+        manifest.contains("[[triggers.cron]]") && manifest.contains("schedule = \"0 0 * * * *\""),
+        "manifest missing cron trigger:\n{manifest}"
+    );
+    assert!(
+        manifest.contains("api_key"),
+        "manifest missing secret name:\n{manifest}"
+    );
+
+    // Script source was written out faithfully.
+    let src = std::fs::read_to_string(out_dir.path().join("scripts/hello.rhai"))
+        .expect("scripts/hello.rhai should be written");
+    assert!(
+        src.contains("hello from pic"),
+        "exported source mismatch:\n{src}"
+    );
+
+    drop(guard);
+}