feat(routes): owner-polymorphic Route + list_effective expansion query (§11 tail R2)

Make the route layer owner-aware ahead of the live rebuild. `Route.app_id`
becomes Option + a `group_id` (mirrors `Trigger`); `NewRoute` carries a
`ScriptOwner` so the interactive API passes App and the reconcile can pass
a group. `insert_route_tx` writes both owner columns; `RouteRow` selects
`group_id` everywhere (the interactive delete/list 404 a group template,
which is apply-managed, not app-addressable).

Adds the two repo methods the live rebuild + apply need:
- `list_for_group` — a group's own route templates (apply diff, ls).
- `list_effective` — the all-apps generalization of CHAIN_LEVELS_CTE: for
  every app, walk its ancestor chain and join routes owned at each level,
  tagging each with the effective (firing) app + the owner's chain depth.
  Runs only on a RouteTable rebuild, never per request; validated with
  EXPLAIN against the live schema.

`compile_route` now takes the effective app_id explicitly (reused next
commit for the per-app expansion); `compile_routes` skips group templates
(no single app) — they materialize via the effective path. Runtime
behavior is unchanged this commit: the table still rebuilds from
`list_all`, and no group routes can exist yet (authoring lands in R4).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/src/app_bootstrap.rs

@@ -6,7 +6,7 @@
 
 use std::sync::Arc;
 
-use picloud_shared::{App, AppId, HostKind, PathKind};
+use picloud_shared::{App, AppId, HostKind, PathKind, ScriptOwner};
 
 use crate::app_repo::AppRepository;
 use crate::repo::{NewScript, ScriptRepository, ScriptRepositoryError};
@@ -76,7 +76,7 @@ async fn seed_into(
 
     routes
         .create(NewRoute {
-            app_id: default.id,
+            owner: ScriptOwner::App(default.id),
             script_id: script.id,
             host_kind: HostKind::Any,
             host: String::new(),