fix(cms-poc): remediate findings surfaced by the CMS proof-of-concept

Additive fixes surfaced by building a full CMS on PiCloud
(examples/cms-poc/). One migration (0077_apps_cors.sql); no destructive
changes.

Security:
- Close the 502 info-leak on user routes: an uncaught script error (incl.
  a throw) leaked the app UUID + script fn names + source line/col. The
  user-route (inbox) path now shares scrub_runtime_detail with the
  execute-by-id path — raw detail is logged under a correlation id and the
  client sees only "script execution error (ref: <uuid>)".

Added:
- docs::find $contains operator (array membership via JSONB @>), per-app
  and group-shared — the inverse of $in.
- App-user role management from API/CLI: pic users add-role / rm-role,
  backed by the apps/{id}/users/{user_id}/roles endpoints (AppUsersAdmin).
- Per-app CORS: pic apps cors set, apps.cors_allowed_origins; the
  orchestrator echoes an allowed Origin and answers OPTIONS preflight.
- Non-JSON request bodies: form-urlencoded -> object, text/* -> string,
  other -> base64; ctx.request.content_type added. Malformed JSON still 400s.
- Binary responses via #{ body_base64 } with a script-set Content-Type.
- workflow::run_status(run_id) SDK (F-038): the starting script can poll a
  run — #{ status, output, error, steps } or () when no such run belongs to
  the app (app_id is the isolation boundary); same AppInvoke gate as start.

Fixed:
- pic apply "app not found" is now actionable (points at pic apps create).
- Interceptor- (F-021) and workflow-step-bound (F-037) scripts no longer
  warn "no route or trigger" at plan time — both count as reachability.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/stdlib-reference.md

@@ -272,6 +272,37 @@ Always include `statusCode` when you mean to set headers or a specific
 body shape. Returning a bare value (`42`, `#{ ok: true }`) is fine — it
 becomes a `200` body as-is.
 
+**Abort with a status by *returning* the envelope, never `throw`.** A
+`throw` (even `throw #{ statusCode: 403 }`) is an uncaught runtime error →
+HTTP 502, not your status. Return a `statusCode` envelope to short-circuit:
+
+```rhai
+if !authorized { return #{ statusCode: 403, body: #{ error: "forbidden" } }; }
+```
+
+### Binary responses — `body_base64`
+
+To return raw bytes (an image, a PDF, a download) instead of JSON, put the
+base64 of the bytes in a `body_base64` field and set `Content-Type`
+yourself. `body` is ignored when `body_base64` is present.
+
+```rhai
+#{ statusCode: 200,
+   headers: #{ "content-type": "image/png" },
+   body_base64: file.data }        // base64 string → raw PNG bytes on the wire
+```
+
+Absent a `Content-Type` the platform defaults to `application/octet-stream`.
+
+### Non-JSON request bodies
+
+`ctx.request.body` is the parsed JSON for a JSON request. A non-JSON body is
+no longer rejected: `application/x-www-form-urlencoded` arrives as an object
+of string fields, `text/*` as the raw string, and any other content type as
+a base64 string of the raw bytes. Read `ctx.request.content_type` (a
+convenience mirror of the `content-type` header) to decide how to interpret
+`ctx.request.body`.
+
 ### Security note — `users::email_available` and account enumeration
 
 `users::email_available(email) -> bool` is the anonymous-safe way to