fix(cms-poc): remediate findings surfaced by the CMS proof-of-concept

Additive fixes surfaced by building a full CMS on PiCloud
(examples/cms-poc/). One migration (0077_apps_cors.sql); no destructive
changes.

Security:
- Close the 502 info-leak on user routes: an uncaught script error (incl.
  a throw) leaked the app UUID + script fn names + source line/col. The
  user-route (inbox) path now shares scrub_runtime_detail with the
  execute-by-id path — raw detail is logged under a correlation id and the
  client sees only "script execution error (ref: <uuid>)".

Added:
- docs::find $contains operator (array membership via JSONB @>), per-app
  and group-shared — the inverse of $in.
- App-user role management from API/CLI: pic users add-role / rm-role,
  backed by the apps/{id}/users/{user_id}/roles endpoints (AppUsersAdmin).
- Per-app CORS: pic apps cors set, apps.cors_allowed_origins; the
  orchestrator echoes an allowed Origin and answers OPTIONS preflight.
- Non-JSON request bodies: form-urlencoded -> object, text/* -> string,
  other -> base64; ctx.request.content_type added. Malformed JSON still 400s.
- Binary responses via #{ body_base64 } with a script-set Content-Type.
- workflow::run_status(run_id) SDK (F-038): the starting script can poll a
  run — #{ status, output, error, steps } or () when no such run belongs to
  the app (app_id is the isolation boundary); same AppInvoke gate as start.

Fixed:
- pic apply "app not found" is now actionable (points at pic apps create).
- Interceptor- (F-021) and workflow-step-bound (F-037) scripts no longer
  warn "no route or trigger" at plan time — both count as reachability.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

crates/manager-core/src/docs_service.rs

@@ -452,6 +452,22 @@ mod tests {
                 };
                 arr.iter().any(|v| actual == json_text(v).as_deref())
             }
+            Contains => {
+                // `actual` is the text rendering of the stored field; for an
+                // array field that's compact JSON. Parse it back and test
+                // element membership, mirroring Postgres `@>` (a scalar field
+                // equal to the value also "contains" it).
+                let Some(text) = actual else {
+                    return false;
+                };
+                match serde_json::from_str::<serde_json::Value>(text) {
+                    Ok(serde_json::Value::Array(items)) => {
+                        items.iter().any(|v| json_text(v).as_deref() == want_ref)
+                    }
+                    Ok(other) => json_text(&other).as_deref() == want_ref,
+                    Err(_) => false,
+                }
+            }
         }
     }
 
@@ -829,6 +845,35 @@ mod tests {
         assert_eq!(hits.len(), 2);
     }
 
+    #[tokio::test]
+    async fn find_with_contains_matches_array_membership() {
+        // F-015: `$contains` finds docs whose ARRAY field holds the element —
+        // the "posts with tag X" query that `$in` cannot express.
+        let s = svc();
+        let cx = anon_cx(AppId::new());
+        s.create(&cx, "posts", json!({ "tags": ["intro", "rust"] }))
+            .await
+            .unwrap();
+        s.create(&cx, "posts", json!({ "tags": ["rust", "async"] }))
+            .await
+            .unwrap();
+        s.create(&cx, "posts", json!({ "tags": ["cooking"] }))
+            .await
+            .unwrap();
+
+        let hits = s
+            .find(&cx, "posts", json!({ "tags": { "$contains": "rust" } }))
+            .await
+            .unwrap();
+        assert_eq!(hits.len(), 2, "expected the two rust-tagged posts");
+
+        let none = s
+            .find(&cx, "posts", json!({ "tags": { "$contains": "python" } }))
+            .await
+            .unwrap();
+        assert!(none.is_empty());
+    }
+
     #[tokio::test]
     async fn find_one_explicit_limit_is_honoured() {
         // The service injects limit=1 ONLY when caller didn't set