feat(hierarchies): trigger templates — per-app fan-out (M4b)

Completes §4.5 templates (M4a shipped routes). A group declares a trigger once;
the tree apply fans it out into one concrete per-app_id trigger on each
descendant app, reusing the M4a expansion engine over the trigger insert path.

- Migration 0054: `trigger_templates` table (group-owned; the whole
  BundleTrigger wire object stored as `spec` JSONB, placeholders unresolved) +
  `triggers.from_template` provenance column + index.
- `template_repo.rs`: trigger-template CRUD + chain-load.
- Manifest: `[group]` `[[trigger_templates]]` (flat: name, kind, script, + kind
  params); build_bundle emits them; rejected on an app node.
- Apply: group nodes reconcile trigger-template rows; tree Phase B expands each
  chain trigger template into a concrete trigger per descendant app —
  placeholders resolved in every spec string leaf, then the typed trigger is
  rebuilt and inserted through the shared `insert_bundle_trigger_tx` (email
  secrets resolved + re-sealed per recipient app). Idempotent via from_template
  (one trigger per template per app; semantic-identity compare → no-op /
  delete+recreate / reap). Collision with a hand-declared trigger or between
  templates is a hard error. Each resolved trigger is re-validated with the
  per-kind shape check (cron/queue/etc.) so a {var:}-injected bad
  schedule/timeout can't slip in.
- Authz: declaring → GroupScriptsWrite; receiving → AppManageTriggers, plus
  AppSecretsRead for email-trigger recipients (parity with hand-declared email).
- Plan/token/report extended for trigger templates; blast radius covers both.
- Tests: tests/templates.rs trigger fan-out (kv + {app_slug}, stable-ids,
  prune-reap); resolve_placeholders_in_json unit test; schema golden reblessed.

Reviewed (no CRITICAL; isolation + per-app email-secret sealing verified
sound). Closed a HIGH validation-parity gap (re-validate resolved triggers) and
a MEDIUM authz gap (AppSecretsRead for email expansions). v1.2 Hierarchies
template work (M4) complete.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

crates/picloud-cli/tests/templates.rs

@@ -208,6 +208,119 @@ fn expansion_colliding_with_hand_declared_route_is_rejected() {
     );
 }
 
+/// Template-expanded kv triggers for the two apps, as `(collection_glob, id)`,
+/// read straight from Postgres (a group-script trigger isn't listable via the
+/// app trigger API). Scoped to the test's two slugs.
+fn trigger_rows(a: &str, b: &str) -> Vec<(String, String)> {
+    let url = std::env::var("DATABASE_URL").expect("DATABASE_URL");
+    let mut pg = PgClient::connect(&url, NoTls).expect("pg connect");
+    let want = [format!("{a}-data"), format!("{b}-data")];
+    let rows = pg
+        .query(
+            "SELECT d.collection_glob, t.id::text FROM triggers t \
+             JOIN kv_trigger_details d ON d.trigger_id = t.id \
+             WHERE t.from_template IS NOT NULL AND d.collection_glob = ANY($1) \
+             ORDER BY d.collection_glob",
+            &[&&want[..]],
+        )
+        .expect("query trigger expansions");
+    rows.iter().map(|r| (r.get(0), r.get(1))).collect()
+}
+
+const TRIGGER_TEMPLATE: &str = "[[trigger_templates]]\nname = \"ev\"\nkind = \"kv\"\n\
+                                script = \"shared\"\ncollection_glob = \"{app_slug}-data\"\n\
+                                ops = [\"insert\"]\n";
+
+#[ignore = "needs DATABASE_URL pointing at a running Postgres"]
+#[test]
+fn trigger_template_fans_out_per_app_idempotently_then_prunes() {
+    let Some(fx) = common::fixture_or_skip() else {
+        return;
+    };
+    let env = common::admin_env(fx);
+    let group = common::unique_slug("ttpl-g");
+    let a = common::unique_slug("ttpl-a");
+    let b = common::unique_slug("ttpl-b");
+
+    let _g = GroupGuard::new(&env.url, &env.token, &group);
+    common::pic_as(&env)
+        .args(["groups", "create", &group])
+        .assert()
+        .success();
+    let _aa = AppGuard::new(&env.url, &env.token, &a);
+    let _ab = AppGuard::new(&env.url, &env.token, &b);
+    for slug in [&a, &b] {
+        common::pic_as(&env)
+            .args(["apps", "create", slug, "--group", &group])
+            .assert()
+            .success();
+    }
+
+    // group manifest: a `shared` script + a kv trigger template using {app_slug}.
+    let dir = TempDir::new().expect("tempdir");
+    fs::create_dir_all(dir.path().join("scripts")).unwrap();
+    fs::write(dir.path().join("scripts/shared.rhai"), r#""x""#).unwrap();
+    let write_group = |with_tmpl: bool| {
+        let tmpl = if with_tmpl { TRIGGER_TEMPLATE } else { "" };
+        fs::write(
+            dir.path().join("picloud.toml"),
+            format!(
+                "[group]\nslug = \"{group}\"\nname = \"TT\"\n\n\
+                 [[scripts]]\nname = \"shared\"\nfile = \"scripts/shared.rhai\"\n\n{tmpl}"
+            ),
+        )
+        .unwrap();
+    };
+    write_group(true);
+    for slug in [&a, &b] {
+        fs::create_dir_all(dir.path().join(slug)).unwrap();
+        fs::write(
+            dir.path().join(slug).join("picloud.toml"),
+            format!("[app]\nslug = \"{slug}\"\nname = \"App\"\n"),
+        )
+        .unwrap();
+    }
+
+    common::pic_as(&env)
+        .args(["apply", "--dir"])
+        .arg(dir.path())
+        .assert()
+        .success();
+    let _gs = ScriptGuard::new(&env.url, &env.token, &group_script_id(&env, &group));
+
+    let first = trigger_rows(&a, &b);
+    assert_eq!(
+        first.iter().map(|(g, _)| g.as_str()).collect::<Vec<_>>(),
+        vec![format!("{a}-data").as_str(), format!("{b}-data").as_str()],
+        "each app gets its own {{app_slug}}-resolved kv trigger"
+    );
+
+    // Idempotent re-apply: same rows, same ids.
+    common::pic_as(&env)
+        .args(["apply", "--dir"])
+        .arg(dir.path())
+        .assert()
+        .success();
+    assert_eq!(
+        trigger_rows(&a, &b),
+        first,
+        "re-apply must not churn triggers"
+    );
+
+    // Remove the template + --prune: trigger expansions reaped.
+    write_group(false);
+    common::pic_as(&env)
+        .args(["apply", "--dir"])
+        .arg(dir.path())
+        .args(["--prune", "--yes"])
+        .assert()
+        .success();
+    assert!(
+        trigger_rows(&a, &b).is_empty(),
+        "removing the trigger template must reap its expansions"
+    );
+}
+
 fn group_script_id(env: &common::TestEnv, group: &str) -> String {
     let ls = common::pic_as(env)
         .args(["scripts", "ls", "--group", group])