feat(enabled): scripts/routes enabled column + declarative data path

Phase-1 `enabled` three-state lifecycle (§4.3), data-model half. Triggers
already carried `enabled`; this adds it to scripts and routes and threads
it through the declarative project tool. Runtime honoring (disabled route
404 / script non-invocable / dispatcher fire-time re-check) is the next
commit — this change only stores and reconciles the flag.

- Migration 0045: `enabled BOOLEAN NOT NULL DEFAULT TRUE` on scripts +
  routes. Default true ⇒ no behavior change on migrate.
- `Script`/`Route` (shared) gain `enabled` (serde default true via the new
  `picloud_shared::default_true`); repos' SELECT/INSERT/UPDATE SQL, row
  structs, `NewScript`/`NewRoute`/`ScriptPatch` all carry it.
- Apply diff treats `enabled` as a declarative field (omitted ⇒ active):
  `script_update_reason` + `diff_routes` detect a toggle as an Update, and
  the create/update/insert paths persist it. The bound-plan `state_token`
  re-includes script/route `enabled` (removed in the earlier review fix
  precisely because the diff didn't key on it yet — now it does).
- CLI manifest model + `build_bundle` + `pull` round-trip `enabled`
  (serialized only when false; omitted ⇒ active). `pic init` scaffold and
  the interactive script/route create paths default active.

Tested: manager-core lib 365 (incl. enabled diff + token sensitivity) +
cli bins 31 (incl. manifest skip-serialize) green; clippy -D warnings
clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/shared/src/lib.rs

@@ -39,6 +39,14 @@ pub mod users;
 pub mod validator;
 pub mod version;
 
+/// serde `default` for `enabled`-style boolean fields that should default to
+/// `true` when absent from the wire (bool's own `Default` is `false`). Shared
+/// by `Script`/`Route`, the apply `Bundle` types, and the CLI manifest.
+#[must_use]
+pub fn default_true() -> bool {
+    true
+}
+
 pub use app::{App, AppDomain, DomainShape};
 pub use auth::{AppRole, InstanceRole, Principal, Scope, UserId};
 pub use crypto::{decrypt, encrypt, CryptoError, EncryptResult, MasterKey, MasterKeyError};

crates/shared/src/route.rs

@@ -99,5 +99,11 @@ pub struct Route {
     #[serde(default)]
     pub dispatch_mode: DispatchMode,
 
+    /// Three-state lifecycle (§4.3): `false` means the route is deployed but
+    /// inert — it is dropped from the compiled match table, so a request 404s
+    /// indistinguishably from an absent route. Defaults `true`.
+    #[serde(default = "crate::default_true")]
+    pub enabled: bool,
+
     pub created_at: DateTime<Utc>,
 }

crates/shared/src/script.rs

@@ -122,6 +122,12 @@ pub struct Script {
     /// have to add it back when that's built.
     pub memory_limit_mb: u32,
 
+    /// Three-state lifecycle (§4.3): `false` means deployed-but-inert — the
+    /// script is not invocable (route 404s, trigger doesn't fire) but stays
+    /// as desired state (not pruned). Defaults `true`.
+    #[serde(default = "crate::default_true")]
+    pub enabled: bool,
+
     pub created_at: DateTime<Utc>,
     pub updated_at: DateTime<Utc>,
 }