feat(modules): group-docs schema + kind-generalized registry (§11.6 docs C1)

Data layer for extending shared group collections from KV to docs. KV behavior
unchanged (callers pass kind="kv").

- 0054_group_docs.sql: widen the group_collections kind CHECK to ('kv','docs')
  and add the group-keyed group_docs store (clone of docs/0013, keyed by
  group_id, CASCADE on group delete) + its (group_id,collection) and data GIN
  indexes.
- group_collection_repo: thread a `kind` parameter through list_for_owner,
  resolve_owning_group, insert/delete_collection_tx; add list_all_for_owner ->
  (name,kind) for the kind-aware diff (D4). Relocate the injectable
  GroupCollectionResolver trait + Postgres impl here (now shared by kv+docs;
  resolve takes kind) — was in group_kv_service.
- group_docs_repo: a near-clone of docs_repo keyed by group_id; find reuses the
  generalized build_find_query.
- docs_repo: generalize build_find_query(table, owner_col, owner_id, …) — both
  are compile-time literals (no injection); app docs passes ("docs","app_id"),
  group docs ("group_docs","group_id"). row_to_doc/build_find_query are now
  pub(crate) for reuse.

Schema snapshot re-blessed (55 migrations).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/migrations/0054_group_docs.sql

@@ -0,0 +1,33 @@
+-- §11.6 (cont., v1.2 Hierarchies): group-shared DOCS collections.
+--
+-- Extends the shared-collection machinery (0052 registry + 0053 group_kv_entries)
+-- from KV to the queryable-JSON `docs` store. The registry's `kind`
+-- discriminator was built for exactly this — widen its CHECK to admit 'docs',
+-- and add a group-keyed storage table mirroring `docs` (0013).
+
+-- Widen the marker kind allow-list. The constraint was an inline column CHECK,
+-- so Postgres auto-named it `group_collections_kind_check`.
+ALTER TABLE group_collections
+    DROP CONSTRAINT group_collections_kind_check,
+    ADD CONSTRAINT group_collections_kind_check CHECK (kind IN ('kv', 'docs'));
+
+-- Group-keyed docs store. Identity tuple `(group_id, collection, id)` — keyed
+-- by the OWNING GROUP, not an app (the shared rows belong to the group). `id`
+-- is a server-generated UUID, as in `docs`. CASCADE on group delete (data dies
+-- with its group; an app delete leaves it), matching group_kv_entries (0053).
+CREATE TABLE group_docs (
+    group_id    UUID NOT NULL REFERENCES groups(id) ON DELETE CASCADE,
+    collection  TEXT NOT NULL,
+    id          UUID NOT NULL,
+    data        JSONB NOT NULL,
+    created_at  TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at  TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    PRIMARY KEY (group_id, collection, id)
+);
+
+-- "all docs in group X / collection Y" — mirrors idx_docs_app_collection (0013).
+CREATE INDEX idx_group_docs_group_collection ON group_docs (group_id, collection);
+
+-- GIN on JSONB (jsonb_path_ops) for the find DSL's equality/containment, same
+-- as idx_docs_data_gin (0013).
+CREATE INDEX idx_group_docs_data_gin ON group_docs USING GIN (data jsonb_path_ops);