feat(modules): GroupDocsService + docs::shared_collection handle (§11.6 docs C3)

The runtime for shared group docs collections, mirroring the group-KV vertical
with the docs surface (filter parsing, JSON-object validation, value-size cap).

- shared: GroupDocsService trait + GroupDocsError (+ CollectionNotShared) +
  NoopGroupDocsService; group_docs field on Services + with_group_docs().
- manager-core: GroupDocsServiceImpl — owning_group resolves kind='docs' from
  cx.app_id's chain (CollectionNotShared off-chain); reads-open (script_gate
  GroupDocsRead) / writes-authed (script_gate_require_principal GroupDocsWrite);
  reuses parse_filter + docs value-size cap; no events. Unit tests cover
  off-chain CollectionNotShared, anon-read-OK/anon-write-Forbidden, non-object
  data rejected.
- executor-core: GroupDocsHandle + docs::shared_collection constructor + the
  create/get/find/find_one/update/delete/list methods (dispatch by receiver
  type), reusing doc_to_map/parse_doc_id.
- picloud: wire PostgresGroupDocsRepo + GroupDocsServiceImpl.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/src/lib.rs

@@ -52,6 +52,7 @@ pub mod files_sweep;
 pub mod gc;
 pub mod group_collection_repo;
 pub mod group_docs_repo;
+pub mod group_docs_service;
 pub mod group_kv_repo;
 pub mod group_kv_service;
 pub mod group_members_repo;
@@ -182,6 +183,7 @@ pub use files_sweep::{spawn_files_orphan_sweep, sweep_orphan_tmp_files, SweepSta
 pub use gc::{spawn_abandoned_gc, spawn_app_user_token_gc, spawn_dead_letter_gc};
 pub use group_collection_repo::{GroupCollectionResolver, PostgresGroupCollectionResolver};
 pub use group_docs_repo::{GroupDocsRepo, GroupDocsRepoError, PostgresGroupDocsRepo};
+pub use group_docs_service::GroupDocsServiceImpl;
 pub use group_kv_repo::{GroupKvRepo, GroupKvRepoError, PostgresGroupKvRepo};
 pub use group_kv_service::GroupKvServiceImpl;
 pub use group_members_repo::{