feat(apply): owner-generic apply engine — group-node plan/apply (Phase 5 C1)

Phase 5 C1. Generalize the reconcile engine from app-only to an `ApplyOwner
{ App | Group }`, so a GROUP's own config + scripts can be declaratively
reconciled — the foundation for the tree-spanning project tool.

A group node is a subset of an app node (scripts + vars only; no routes /
triggers / secrets-values), so the diff, script/route/trigger/var CRUD, prune,
idempotency, and the Phase-4 inherited-target resolution are all reused
unchanged. Only the owner-varying bits switch on `ApplyOwner`:
  * `load_current` — `list_for_group` + `VarOwner::Group` for a group (empty
    routes/triggers/secrets); `list_for_app` for an app, exactly as before.
  * script create owner (`NewScript{app_id|group_id}`), var writes (new
    `set_group_var_tx`/`delete_group_var_tx` mirroring the app variants at
    scope `*`), and the advisory lock (owner-tagged).
  * `validate_bundle_for` rejects routes/triggers on a group bundle (422);
    route-host validation, inherited-target resolution, the post-commit route
    refresh, and the unreachable-endpoint warning are app-only.

`apply`/`plan` are unchanged thin wrappers over the new `apply_owner`/
`plan_owner`. New endpoints `POST /groups/{id}/{plan,apply}` gated by
`GroupScripts{Read,Write}` / `GroupVarsWrite`. `ApplyService` gains a `groups`
repo (the tree apply in C3 needs it too).

Live-validated: group plan → apply (group-owned script + var) → idempotent
re-plan noop → routes rejected 422 → DB confirms group ownership. App apply
unchanged: 391 manager-core unit tests + the apply/prune/staleness/overlay
journeys all green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/src/apply_api.rs

@@ -11,21 +11,24 @@ use axum::{
     routing::post,
     Extension, Json, Router,
 };
-use picloud_shared::{AppId, Principal};
+use picloud_shared::{AppId, GroupId, Principal};
 use serde::Deserialize;
 use serde_json::json;
 
 use crate::app_repo::AppRepository;
 use crate::apply_service::{
-    ApplyError, ApplyReport, ApplyService, Bundle, BundleTrigger, PlanResult,
+    ApplyError, ApplyOwner, ApplyReport, ApplyService, Bundle, BundleTrigger, PlanResult,
 };
 use crate::authz::{require, AuthzDenied, Capability};
+use crate::group_repo::GroupRepository;
 
 /// Build the apply/plan router. Mounted under `/api/v1/admin`.
 pub fn apply_router(service: ApplyService) -> Router {
     Router::new()
         .route("/apps/{id}/plan", post(plan_handler))
         .route("/apps/{id}/apply", post(apply_handler))
+        .route("/groups/{id}/plan", post(group_plan_handler))
+        .route("/groups/{id}/apply", post(group_apply_handler))
         .with_state(service)
 }
 
@@ -135,6 +138,91 @@ async fn plan_handler(
     Ok(Json(plan))
 }
 
+// ----------------------------------------------------------------------------
+// Group node apply (Phase 5): a group declares only scripts + vars (+ secret
+// names). The bundle reuses the app `Bundle` shape with empty routes/triggers;
+// the service rejects routes/triggers on a group node.
+// ----------------------------------------------------------------------------
+
+async fn group_plan_handler(
+    State(svc): State<ApplyService>,
+    Extension(principal): Extension<Principal>,
+    Path(id_or_slug): Path<String>,
+    Json(bundle): Json<Bundle>,
+) -> Result<Json<PlanResult>, ApplyError> {
+    let group_id = resolve_group_id(svc.groups.as_ref(), &id_or_slug).await?;
+    // Plan discloses the group's script + var + secret names; viewer-tier reads.
+    require(
+        svc.authz.as_ref(),
+        &principal,
+        Capability::GroupScriptsRead(group_id),
+    )
+    .await
+    .map_err(map_authz)?;
+    let plan = svc.plan_owner(ApplyOwner::Group(group_id), &bundle).await?;
+    Ok(Json(plan))
+}
+
+async fn group_apply_handler(
+    State(svc): State<ApplyService>,
+    Extension(principal): Extension<Principal>,
+    Path(id_or_slug): Path<String>,
+    Json(req): Json<ApplyRequest>,
+) -> Result<Json<ApplyReport>, ApplyError> {
+    let group_id = resolve_group_id(svc.groups.as_ref(), &id_or_slug).await?;
+    // Write caps per touched kind (+ all kinds on prune). Group scripts are
+    // editor-tier (`GroupScriptsWrite`), group vars likewise (`GroupVarsWrite`).
+    if req.prune || !req.bundle.scripts.is_empty() {
+        require(
+            svc.authz.as_ref(),
+            &principal,
+            Capability::GroupScriptsWrite(group_id),
+        )
+        .await
+        .map_err(map_authz)?;
+    }
+    if req.prune || !req.bundle.vars.is_empty() {
+        require(
+            svc.authz.as_ref(),
+            &principal,
+            Capability::GroupVarsWrite(group_id),
+        )
+        .await
+        .map_err(map_authz)?;
+    }
+    let report = svc
+        .apply_owner(
+            ApplyOwner::Group(group_id),
+            &req.bundle,
+            req.prune,
+            principal.user_id,
+            req.expected_token.as_deref(),
+        )
+        .await?;
+    Ok(Json(report))
+}
+
+/// Resolve a slug-or-id path param to a `GroupId`, mapping miss → 404.
+async fn resolve_group_id(
+    groups: &dyn GroupRepository,
+    ident: &str,
+) -> Result<GroupId, ApplyError> {
+    let found = if let Ok(uuid) = ident.parse::<uuid::Uuid>() {
+        groups
+            .get_by_id(uuid.into())
+            .await
+            .map_err(|e| ApplyError::Backend(e.to_string()))?
+    } else {
+        groups
+            .get_by_slug(ident)
+            .await
+            .map_err(|e| ApplyError::Backend(e.to_string()))?
+    };
+    found
+        .map(|g| g.id)
+        .ok_or_else(|| ApplyError::AppNotFound(format!("group {ident}")))
+}
+
 /// Resolve a slug-or-id path param to an `AppId`, mapping miss → 404.
 /// Mirrors the `triggers_api` helper of the same shape.
 async fn resolve_app_id(apps: &dyn AppRepository, ident: &str) -> Result<AppId, ApplyError> {