feat(suppress): pic suppress ls --app + dangling-suppress warning (§11 tail S4)

Visibility + typo guard.

- `pic suppress ls --app <a>` — read-only (kind, reference):
  ApplyService::suppression_report(App) → GET /apps/{id}/suppressions
  (viewer-tier AppRead), client + cmd + main.rs wiring.
- Dangling-suppress warning: at apply, a suppress reference that matches no
  inherited template on the app's chain (no ancestor-group trigger bound to
  that script name / no ancestor-group route at that path) emits an
  ApplyReport warning — the suppression silently does nothing otherwise.
  Soft (never fails the apply), reusing the existing warnings channel.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/main.rs

@@ -171,6 +171,14 @@ enum Cmd {
         cmd: CollectionsCmd,
     },
 
+    /// Per-app opt-out of inherited group templates (§11 tail). Authoring is
+    /// declarative via the `[suppress]` manifest block; this lists what an app
+    /// declines.
+    Suppress {
+        #[command(subcommand)]
+        cmd: SuppressCmd,
+    },
+
     /// Files inspection — list a collection's blobs, download bytes, or
     /// delete a file. Read + delete only; writes go through scripts.
     Files {
@@ -577,6 +585,15 @@ enum CollectionsCmd {
     },
 }
 
+#[derive(Subcommand)]
+enum SuppressCmd {
+    /// List the inherited templates an app declines (§11 tail). App-only.
+    Ls {
+        #[arg(long)]
+        app: String,
+    },
+}
+
 #[derive(Subcommand)]
 enum ScriptsCmd {
     /// List scripts. With `--app`, scoped to one app; with `--group`, a
@@ -2024,6 +2041,9 @@ async fn main() -> ExitCode {
         Cmd::Collections {
             cmd: CollectionsCmd::Ls { group },
         } => cmds::collections::ls(&group, mode).await,
+        Cmd::Suppress {
+            cmd: SuppressCmd::Ls { app },
+        } => cmds::suppress::ls(&app, mode).await,
         Cmd::Files {
             cmd:
                 FilesCmd::Ls {