feat(cli): pic config --effective (masked secret resolution)

The §11 Phase-1 `config --effective` surface. Single-app today, "config"
= the app's secrets, so it cross-references the manifest's declared
secret names against what's set on the server and renders each masked:
`<set>` (managed / on-server-not-in-manifest) or `<unset>` (declared but
not pushed). Values are never fetched or shown (§4.6). Shaped to grow an
`--explain` mode and inherited `vars` when groups/vars arrive (Phase 3).

Tested: a journey verifying declared-but-unset → `<unset>`, post-`secret
set` → `<set>`/managed, and the value never appears in output.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/main.rs

@@ -177,6 +177,10 @@ enum Cmd {
     /// app), `scripts/hello.rhai`, and a `.gitignore`. Offline; deploy with
     /// `pic plan` then `pic apply`.
     Init(InitArgs),
+
+    /// Show an app's resolved configuration. `--effective` lists secrets with
+    /// values masked (`<set>`/`<unset>`), cross-referenced against the manifest.
+    Config(ConfigArgs),
 }
 
 #[derive(Args)]
@@ -230,6 +234,16 @@ struct InitArgs {
     force: bool,
 }
 
+#[derive(Args)]
+struct ConfigArgs {
+    /// Path to the manifest.
+    #[arg(long, default_value = "picloud.toml")]
+    file: PathBuf,
+    /// Show the effective (resolved) config with secrets masked.
+    #[arg(long)]
+    effective: bool,
+}
+
 #[derive(Subcommand)]
 enum KvCmd {
     /// List keys in a collection.
@@ -1122,6 +1136,7 @@ async fn main() -> ExitCode {
         }
         Cmd::Plan(args) => cmds::plan::run(&args.file, mode).await,
         Cmd::Pull(args) => cmds::pull::run(&args.app, &args.dir, mode).await,
+        Cmd::Config(args) => cmds::config::run(&args.file, args.effective, mode).await,
         Cmd::Init(args) => cmds::init::run(
             &args.dir,
             args.slug.as_deref(),