feat(suppress): pic suppress ls --app + dangling-suppress warning (§11 tail S4)

Visibility + typo guard.

- `pic suppress ls --app <a>` — read-only (kind, reference):
  ApplyService::suppression_report(App) → GET /apps/{id}/suppressions
  (viewer-tier AppRead), client + cmd + main.rs wiring.
- Dangling-suppress warning: at apply, a suppress reference that matches no
  inherited template on the app's chain (no ancestor-group trigger bound to
  that script name / no ancestor-group route at that path) emits an
  ApplyReport warning — the suppression silently does nothing otherwise.
  Soft (never fails the apply), reusing the existing warnings channel.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/client.rs

@@ -1371,6 +1371,29 @@ impl Client {
             .await?;
         decode(resp).await
     }
+
+    /// `GET /api/v1/admin/apps/{ident}/suppressions` (§11 tail). App-only — the
+    /// inherited templates the app declines.
+    pub async fn suppressions_list(&self, app_ident: &str) -> Result<Vec<SuppressionDto>> {
+        let ident = seg(app_ident);
+        let resp = self
+            .request(
+                Method::GET,
+                &format!("/api/v1/admin/apps/{ident}/suppressions"),
+            )
+            .send()
+            .await?;
+        decode(resp).await
+    }
+}
+
+/// One row of the §11 tail suppression report.
+#[derive(Debug, Deserialize)]
+pub struct SuppressionDto {
+    #[serde(default)]
+    pub target_kind: String,
+    #[serde(default)]
+    pub reference: String,
 }
 
 /// One row of the §11 tail trigger-template report.