feat(suppress): consume per-app suppressions at trigger + route dispatch (§11 tail S3)

The runtime half — suppressions now actually decline inherited templates.

- Triggers (live, per-event): a correlated NOT EXISTS anti-join
  (TRIGGER_SUPPRESSION_ANTIJOIN) appended to all four dispatch match
  queries (list_matching_kv/docs/files + the pubsub fan-out). It excludes a
  group-owned trigger whose handler script name the firing app suppresses;
  `$1` is the firing app (already bound), and the `t.group_id IS NOT NULL`
  guard keeps an app's OWN trigger unsuppressable.
- Routes (rebuild-time): compile_effective_routes takes a
  `suppressed_paths: &HashSet<(AppId, path)>` and drops an inherited
  (`depth > 0`) route at a suppressed path — the binding 404s.
  rebuild_route_table loads the set via a new
  RouteRepository::list_route_suppressions, so every existing rebuild edge
  (route CRUD, apply, tree mutations) already applies it. No new
  invalidation edges; the marker CASCADEs on app delete.

Pinned by tests/template_suppression.rs (live DB): a suppressing app
matches NEITHER the inherited trigger NOR route; a sibling that did not
suppress still inherits both; the app's OWN trigger on the suppressed
handler still fires (suppression is inheritance-only).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/tests/group_route_templates.rs

@@ -63,7 +63,13 @@ async fn app_under(pool: &PgPool, slug: &str, group: Uuid) -> Uuid {
 /// ancestor-group templates, after nearest-wins shadowing.
 async fn slice_paths(repo: &PostgresRouteRepository, app: Uuid) -> Vec<(String, Uuid)> {
     let effective = repo.list_effective().await.expect("list_effective");
-    compile_effective_routes(&effective)
+    let suppressed = repo
+        .list_route_suppressions()
+        .await
+        .expect("list_route_suppressions")
+        .into_iter()
+        .collect();
+    compile_effective_routes(&effective, &suppressed)
         .into_iter()
         .filter(|c| c.app_id == AppId::from(app))
         .map(|c| {