feat(suppress): pic suppress ls --app + dangling-suppress warning (§11 tail S4)

Visibility + typo guard.

- `pic suppress ls --app <a>` — read-only (kind, reference):
  ApplyService::suppression_report(App) → GET /apps/{id}/suppressions
  (viewer-tier AppRead), client + cmd + main.rs wiring.
- Dangling-suppress warning: at apply, a suppress reference that matches no
  inherited template on the app's chain (no ancestor-group trigger bound to
  that script name / no ancestor-group route at that path) emits an
  ApplyReport warning — the suppression silently does nothing otherwise.
  Soft (never fails the apply), reusing the existing warnings channel.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/cmds/mod.rs

@@ -21,6 +21,7 @@ pub mod queues;
 pub mod routes;
 pub mod scripts;
 pub mod secrets;
+pub mod suppress;
 pub mod topics;
 pub mod triggers;
 pub mod users;

crates/picloud-cli/src/cmds/suppress.rs

@@ -0,0 +1,23 @@
+//! `pic suppress ls --app <a>` — read-only view of an app's §11 tail
+//! per-app opt-outs: the inherited group templates it declines. App-only;
+//! authoring is declarative via the `[suppress]` block (`triggers = [...]`
+//! handler script names, `routes = [...]` paths).
+
+use anyhow::Result;
+
+use crate::client::Client;
+use crate::config;
+use crate::output::{OutputMode, Table};
+
+pub async fn ls(app: &str, mode: OutputMode) -> Result<()> {
+    let creds = config::resolve()?;
+    let client = Client::from_creds(&creds)?;
+    let items = client.suppressions_list(app).await?;
+
+    let mut table = Table::new(["kind", "reference"]);
+    for s in &items {
+        table.row([s.target_kind.clone(), s.reference.clone()]);
+    }
+    table.print(mode);
+    Ok(())
+}