feat(suppress): consume per-app suppressions at trigger + route dispatch (§11 tail S3)

The runtime half — suppressions now actually decline inherited templates.

- Triggers (live, per-event): a correlated NOT EXISTS anti-join
  (TRIGGER_SUPPRESSION_ANTIJOIN) appended to all four dispatch match
  queries (list_matching_kv/docs/files + the pubsub fan-out). It excludes a
  group-owned trigger whose handler script name the firing app suppresses;
  `$1` is the firing app (already bound), and the `t.group_id IS NOT NULL`
  guard keeps an app's OWN trigger unsuppressable.
- Routes (rebuild-time): compile_effective_routes takes a
  `suppressed_paths: &HashSet<(AppId, path)>` and drops an inherited
  (`depth > 0`) route at a suppressed path — the binding 404s.
  rebuild_route_table loads the set via a new
  RouteRepository::list_route_suppressions, so every existing rebuild edge
  (route CRUD, apply, tree mutations) already applies it. No new
  invalidation edges; the marker CASCADEs on app delete.

Pinned by tests/template_suppression.rs (live DB): a suppressing app
matches NEITHER the inherited trigger NOR route; a sibling that did not
suppress still inherits both; the app's OWN trigger on the suppressed
handler still fires (suppression is inheritance-only).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/src/route_admin.rs

@@ -406,7 +406,14 @@ pub async fn rebuild_route_table(
     table: &RouteTable,
 ) -> Result<(), ScriptRepositoryError> {
     let effective = routes.list_effective().await?;
-    let compiled = compile_effective_routes(&effective);
+    // §11 tail: `(app_id, path)` route suppressions — an inherited route at a
+    // suppressed path is dropped from the app's slice (404).
+    let suppressed: std::collections::HashSet<(AppId, String)> = routes
+        .list_route_suppressions()
+        .await?
+        .into_iter()
+        .collect();
+    let compiled = compile_effective_routes(&effective, &suppressed);
     table.replace_all(compiled);
     Ok(())
 }
@@ -429,14 +436,23 @@ pub async fn rebuild_route_table(
 /// **Disabled + inherited (§4.3 semantic):** the `enabled` filter runs *before*
 /// the shadow check, so a **disabled** own-route does NOT claim its binding — an
 /// enabled ancestor-group template at the same binding then falls through and
-/// serves (disabled = "indistinguishable from absent"). The corollary: a
-/// descendant cannot 404 an inherited route by disabling a same-path own route;
-/// a true per-app opt-out is deferred (§4.5).
+/// serves (disabled = "indistinguishable from absent"). To actually 404 an
+/// inherited route, a descendant SUPPRESSES its path (§11 tail, the
+/// `suppressed_paths` set) — the deliberate per-app opt-out.
+///
+/// `suppressed_paths` holds `(app_id, path)` route suppressions: an INHERITED
+/// row (`depth > 0`) whose `(effective_app_id, path)` is present is skipped
+/// entirely (the binding is absent → 404). Gated to `depth > 0` so an app can
+/// only decline what it inherits, never its own route.
 ///
 /// Requires `rows` ordered by `(effective_app_id, depth ASC)` — which
 /// [`RouteRepository::list_effective`] guarantees — so first-seen is nearest.
 #[must_use]
-pub fn compile_effective_routes(rows: &[EffectiveRoute]) -> Vec<CompiledRoute> {
+#[allow(clippy::implicit_hasher)] // every caller uses the default hasher
+pub fn compile_effective_routes(
+    rows: &[EffectiveRoute],
+    suppressed_paths: &std::collections::HashSet<(AppId, String)>,
+) -> Vec<CompiledRoute> {
     let mut seen: std::collections::HashSet<(AppId, String)> = std::collections::HashSet::new();
     let mut out = Vec::new();
     for er in rows {
@@ -445,6 +461,12 @@ pub fn compile_effective_routes(rows: &[EffectiveRoute]) -> Vec<CompiledRoute> {
         if !er.route.enabled {
             continue;
         }
+        // §11 tail: an inherited route whose path this app suppresses is
+        // dropped — the binding 404s. Gated to inherited rows (`depth > 0`).
+        if er.depth > 0 && suppressed_paths.contains(&(er.effective_app_id, er.route.path.clone()))
+        {
+            continue;
+        }
         // A nearer owner already claimed this binding for this app → shadow.
         if !seen.insert((er.effective_app_id, binding_key(&er.route))) {
             continue;
@@ -739,6 +761,11 @@ mod tests {
         }
     }
 
+    /// No route suppressions — the common case for these compile tests.
+    fn no_suppress() -> std::collections::HashSet<(AppId, String)> {
+        std::collections::HashSet::new()
+    }
+
     #[test]
     fn compile_effective_skips_uncompilable_rows_instead_of_failing() {
         // H1 regression guard: a stored route whose path is now reserved
@@ -750,7 +777,7 @@ mod tests {
         let good_b = route_with_path("/items");
         let rows = [eff(&good_a), eff(&bad), eff(&good_b)];
 
-        let compiled = compile_effective_routes(&rows);
+        let compiled = compile_effective_routes(&rows, &no_suppress());
 
         let ids: Vec<Uuid> = compiled.iter().map(|c| c.route_id).collect();
         assert_eq!(compiled.len(), 2, "the reserved row must be dropped");
@@ -769,7 +796,7 @@ mod tests {
         let active = route_with_path("/on");
         let mut disabled = route_with_path("/off");
         disabled.enabled = false;
-        let compiled = compile_effective_routes(&[eff(&active), eff(&disabled)]);
+        let compiled = compile_effective_routes(&[eff(&active), eff(&disabled)], &no_suppress());
         let ids: Vec<Uuid> = compiled.iter().map(|c| c.route_id).collect();
         assert_eq!(ids, vec![active.id], "only the enabled route compiles");
     }
@@ -804,7 +831,7 @@ mod tests {
                 route: other_template.clone(),
             },
         ];
-        let ids: Vec<Uuid> = compile_effective_routes(&rows)
+        let ids: Vec<Uuid> = compile_effective_routes(&rows, &no_suppress())
             .iter()
             .map(|c| c.route_id)
             .collect();