feat(manager-core,orchestrator-core): multi-app scoping (Phase 3b)

Apps become the isolation boundary for scripts, routes, domains, and
later data. Doing this now — while the surface is small — avoids
several migrations on populated tables once v1.1 data-plane services
ship.

Schema (migration 0005_apps.sql):
- New tables: apps, app_domains (with shape_key UNIQUE for collision
  detection), app_slug_history (for permanent slug-rename redirects).
- app_id added to scripts, routes, execution_logs (non-null, cascading
  rules per row).
- Script-name uniqueness becomes per-app; the route unique index is
  swapped for an app-scoped version.
- The "default" app is seeded unconditionally with a localhost claim;
  existing scripts/routes backfill into it. Fresh installs additionally
  get the Hello World seed via seed_hello_world_if_fresh after
  migrations run (idempotent — only fires when the default app has no
  scripts).

Orchestrator dispatch is two-phase: AppDomainTable resolves Host →
app_id (most-specific match wins, exact beats wildcard), then the
existing route matcher runs against that app's partitioned slice via
RouteTable. Unknown hosts return 404 at the app layer with a clear
message; /api/v1/execute/{id} still works as the implicit
__internal__ claim, decoupled from any public domain.

Manager API: full CRUD for /api/v1/admin/apps/* and
/api/v1/admin/apps/{id_or_slug}/domains/*, with slug:check + force
takeover semantics implementing the rename-history flow (two-step
check → confirm, never a single endpoint). Script create requires
app_id; list accepts ?app= filter. Route create validates host
against the parent app's claims; conflict detection stays strictly
intra-app.

Dashboard: /admin/apps and /admin/apps/{slug} (overview + scripts +
domains + settings tabs, with slug-history-aware redirects). Root
path redirects to the apps list. Script detail page gains an app
breadcrumb and threads app_id into the route preview.

Deferred per design: per-app admin roles. The require_admin middleware
remains the seam where role checks will slot in later.

Blueprint §11.5 and roadmap updated to reflect what shipped; docs/
versioning.md notes the schema 3 → 5 bump.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

dashboard/src/routes/scripts/[id]/+page.svelte

@@ -38,6 +38,8 @@
 	let scriptLoading = $state(true);
 	let info = $state<VersionInfo | null>(null);
 
+	let appSlug = $state<string | null>(null);
+
 	async function loadScript() {
 		scriptLoading = true;
 		scriptError = null;
@@ -48,6 +50,14 @@
 			editableDescription = script.description ?? '';
 			editableTimeout = script.timeout_seconds;
 			editableSandbox = { ...(script.sandbox ?? {}) };
+			// Resolve the owning app's slug for the breadcrumb. Failure
+			// is non-fatal — the page works without it.
+			void api.apps
+				.get(script.app_id)
+				.then((a) => {
+					appSlug = a.slug;
+				})
+				.catch(() => {});
 		} catch (e) {
 			scriptError = e instanceof Error ? e.message : String(e);
 			script = null;
@@ -251,8 +261,9 @@
 
 	async function runPreview() {
 		previewResult = null;
+		if (!script) return;
 		try {
-			const r = await api.routes.match(previewUrl, previewMethod);
+			const r = await api.routes.match(script.app_id, previewUrl, previewMethod);
 			if (r.matched) {
 				const ours = r.matched.script_id === id;
 				const tag = ours ? '✓ matches THIS script' : '⚠ matches a DIFFERENT script';
@@ -368,6 +379,13 @@
 	{:else if script}
 		<header class="page-header">
 			<div>
+				{#if appSlug}
+					<div class="breadcrumb">
+						<a href="{base}/apps">Apps</a> /
+						<a href="{base}/apps/{appSlug}">{appSlug}</a> / Scripts /
+						<code>{script.name}</code>
+					</div>
+				{/if}
 				<h1>{script.name}</h1>
 				<p class="muted">
 					v{script.version} · timeout {script.timeout_seconds}s · {script.description ?? 'no description'}
@@ -756,6 +774,23 @@
 		align-items: flex-start;
 		margin: 1rem 0 1.5rem;
 	}
+	.breadcrumb {
+		font-size: 0.875rem;
+		color: #64748b;
+		margin-bottom: 0.25rem;
+	}
+	.breadcrumb a {
+		color: #94a3b8;
+		text-decoration: none;
+	}
+	.breadcrumb a:hover {
+		color: #e2e8f0;
+	}
+	.breadcrumb code {
+		background: #1e293b;
+		padding: 0.1rem 0.3rem;
+		border-radius: 0.25rem;
+	}
 	h1 {
 		margin: 0;
 		font-size: 1.5rem;