feat(suppress): pic suppress ls --app + dangling-suppress warning (§11 tail S4)

Visibility + typo guard.

- `pic suppress ls --app <a>` — read-only (kind, reference):
  ApplyService::suppression_report(App) → GET /apps/{id}/suppressions
  (viewer-tier AppRead), client + cmd + main.rs wiring.
- Dangling-suppress warning: at apply, a suppress reference that matches no
  inherited template on the app's chain (no ancestor-group trigger bound to
  that script name / no ancestor-group route at that path) emits an
  ApplyReport warning — the suppression silently does nothing otherwise.
  Soft (never fails the apply), reusing the existing warnings channel.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/client.rs

@@ -1371,6 +1371,29 @@ impl Client {
             .await?;
         decode(resp).await
     }
+
+    /// `GET /api/v1/admin/apps/{ident}/suppressions` (§11 tail). App-only — the
+    /// inherited templates the app declines.
+    pub async fn suppressions_list(&self, app_ident: &str) -> Result<Vec<SuppressionDto>> {
+        let ident = seg(app_ident);
+        let resp = self
+            .request(
+                Method::GET,
+                &format!("/api/v1/admin/apps/{ident}/suppressions"),
+            )
+            .send()
+            .await?;
+        decode(resp).await
+    }
+}
+
+/// One row of the §11 tail suppression report.
+#[derive(Debug, Deserialize)]
+pub struct SuppressionDto {
+    #[serde(default)]
+    pub target_kind: String,
+    #[serde(default)]
+    pub reference: String,
 }
 
 /// One row of the §11 tail trigger-template report.

crates/picloud-cli/src/cmds/mod.rs

@@ -21,6 +21,7 @@ pub mod queues;
 pub mod routes;
 pub mod scripts;
 pub mod secrets;
+pub mod suppress;
 pub mod topics;
 pub mod triggers;
 pub mod users;

crates/picloud-cli/src/cmds/suppress.rs

@@ -0,0 +1,23 @@
+//! `pic suppress ls --app <a>` — read-only view of an app's §11 tail
+//! per-app opt-outs: the inherited group templates it declines. App-only;
+//! authoring is declarative via the `[suppress]` block (`triggers = [...]`
+//! handler script names, `routes = [...]` paths).
+
+use anyhow::Result;
+
+use crate::client::Client;
+use crate::config;
+use crate::output::{OutputMode, Table};
+
+pub async fn ls(app: &str, mode: OutputMode) -> Result<()> {
+    let creds = config::resolve()?;
+    let client = Client::from_creds(&creds)?;
+    let items = client.suppressions_list(app).await?;
+
+    let mut table = Table::new(["kind", "reference"]);
+    for s in &items {
+        table.row([s.target_kind.clone(), s.reference.clone()]);
+    }
+    table.print(mode);
+    Ok(())
+}

crates/picloud-cli/src/main.rs

@@ -171,6 +171,14 @@ enum Cmd {
         cmd: CollectionsCmd,
     },
 
+    /// Per-app opt-out of inherited group templates (§11 tail). Authoring is
+    /// declarative via the `[suppress]` manifest block; this lists what an app
+    /// declines.
+    Suppress {
+        #[command(subcommand)]
+        cmd: SuppressCmd,
+    },
+
     /// Files inspection — list a collection's blobs, download bytes, or
     /// delete a file. Read + delete only; writes go through scripts.
     Files {
@@ -577,6 +585,15 @@ enum CollectionsCmd {
     },
 }
 
+#[derive(Subcommand)]
+enum SuppressCmd {
+    /// List the inherited templates an app declines (§11 tail). App-only.
+    Ls {
+        #[arg(long)]
+        app: String,
+    },
+}
+
 #[derive(Subcommand)]
 enum ScriptsCmd {
     /// List scripts. With `--app`, scoped to one app; with `--group`, a
@@ -2024,6 +2041,9 @@ async fn main() -> ExitCode {
         Cmd::Collections {
             cmd: CollectionsCmd::Ls { group },
         } => cmds::collections::ls(&group, mode).await,
+        Cmd::Suppress {
+            cmd: SuppressCmd::Ls { app },
+        } => cmds::suppress::ls(&app, mode).await,
         Cmd::Files {
             cmd:
                 FilesCmd::Ls {