feat(routes): live group-route expansion + full-live invalidation (§11 tail R3)

The runtime half. Group route TEMPLATES now expand into every descendant
app's in-memory match slice, live, with no per-app materialization.

- `compile_effective_routes` consumes the `list_effective` expansion and
  applies NEAREST-OWNER-WINS shadowing: for one app, identical binding
  tuples (method+host+path) owned at multiple chain levels collapse to the
  nearest (an app's own route shadows an ancestor-group template); a nearer
  group beats a farther one. Non-identical bindings coexist and the
  existing matcher precedence resolves each request. `compile_route` now
  takes the effective app_id, so the matcher + dispatch are unchanged.
- `rebuild_route_table` is the single refresh chokepoint (list_effective →
  compile_effective_routes → replace_all). Route CRUD, the apply reconcile,
  and startup all route through it; the apply guards drop the "a group node
  touches no routes" assumption (a group apply may now create templates).
- FULL-LIVE INVALIDATION: app create/delete (apps_api) and group reparent
  (groups_api) rebuild the snapshot, so inherited routes take effect the
  instant the tree changes — matching the live model of triggers/vars.
  Best-effort, mirroring apply: a failed rebuild self-heals on the next
  write or restart, never failing the committed mutation.

The isolation boundary is the chain expansion: a template lands only in the
slices of apps whose ancestor chain contains the owning group. Pinned by a
deterministic live-DB integration test (descendant inherits, sibling
subtree does not, app shadows by identical binding, non-identical coexists).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/src/apply_service.rs

@@ -1173,9 +1173,10 @@ impl ApplyService {
 
         // Post-commit: rebuild the orchestrator's route snapshot once. A
         // failure here doesn't undo the committed DB write — the table
-        // self-heals on the next route write or restart. A group node touches
-        // no routes, so there's nothing to refresh.
-        if matches!(owner, ApplyOwner::App(_)) {
+        // self-heals on the next route write or restart. §11 tail: a GROUP node
+        // may now declare route TEMPLATES, so refresh on either owner (the
+        // rebuild expands templates into every descendant app's slice).
+        {
             if let Err(e) = self.refresh_route_table().await {
                 tracing::warn!(error = %e, "apply: route table refresh failed");
                 report
@@ -1254,7 +1255,6 @@ impl ApplyService {
 
         let mut report = ApplyReport::default();
         let mut group_script_index: HashMap<GroupId, HashMap<String, ScriptId>> = HashMap::new();
-        let mut any_app = false;
 
         // Phase A — groups first: reconcile each and record its post-create
         // `name -> id` so descendant app nodes can resolve inherited bindings.
@@ -1285,7 +1285,6 @@ impl ApplyService {
         // ids just created) and pre-existing ancestors, then reconcile.
         for p in &prepared {
             if let ApplyOwner::App(_) = p.owner {
-                any_app = true;
                 report
                     .warnings
                     .extend(disabled_target_warnings(&p.node.bundle));
@@ -1314,14 +1313,15 @@ impl ApplyService {
         tx.commit()
             .await
             .map_err(|e| ApplyError::Backend(e.to_string()))?;
-        // One post-commit route refresh covers every app node touched.
-        if any_app {
-            if let Err(e) = self.refresh_route_table().await {
-                tracing::warn!(error = %e, "apply_tree: route table refresh failed");
-                report
-                    .warnings
-                    .push("route table refresh failed; it will self-heal".into());
-            }
+        // One post-commit route refresh covers the whole tree. §11 tail: a
+        // group node may declare route TEMPLATES affecting descendant apps even
+        // when no app node is in this apply, so refresh unconditionally (a full
+        // rebuild; cheap relative to a tree apply).
+        if let Err(e) = self.refresh_route_table().await {
+            tracing::warn!(error = %e, "apply_tree: route table refresh failed");
+            report
+                .warnings
+                .push("route table refresh failed; it will self-heal".into());
         }
         Ok(report)
     }
@@ -1608,14 +1608,11 @@ impl ApplyService {
     }
 
     async fn refresh_route_table(&self) -> Result<(), ApplyError> {
-        let rows = self
-            .routes
-            .list_all()
+        // §11 tail: rebuild via the live expansion so a group route TEMPLATE
+        // created in this apply lands in every descendant app's slice.
+        crate::route_admin::rebuild_route_table(self.routes.as_ref(), &self.route_table)
             .await
-            .map_err(|e| ApplyError::Backend(e.to_string()))?;
-        let compiled = crate::route_admin::compile_routes(&rows);
-        self.route_table.replace_all(compiled);
-        Ok(())
+            .map_err(|e| ApplyError::Backend(e.to_string()))
     }
 
     /// Resolve a referenced secret to plaintext, then re-seal it for an