feat(routes): live group-route expansion + full-live invalidation (§11 tail R3)

The runtime half. Group route TEMPLATES now expand into every descendant
app's in-memory match slice, live, with no per-app materialization.

- `compile_effective_routes` consumes the `list_effective` expansion and
  applies NEAREST-OWNER-WINS shadowing: for one app, identical binding
  tuples (method+host+path) owned at multiple chain levels collapse to the
  nearest (an app's own route shadows an ancestor-group template); a nearer
  group beats a farther one. Non-identical bindings coexist and the
  existing matcher precedence resolves each request. `compile_route` now
  takes the effective app_id, so the matcher + dispatch are unchanged.
- `rebuild_route_table` is the single refresh chokepoint (list_effective →
  compile_effective_routes → replace_all). Route CRUD, the apply reconcile,
  and startup all route through it; the apply guards drop the "a group node
  touches no routes" assumption (a group apply may now create templates).
- FULL-LIVE INVALIDATION: app create/delete (apps_api) and group reparent
  (groups_api) rebuild the snapshot, so inherited routes take effect the
  instant the tree changes — matching the live model of triggers/vars.
  Best-effort, mirroring apply: a failed rebuild self-heals on the next
  write or restart, never failing the committed mutation.

The isolation boundary is the chain expansion: a template lands only in the
slices of apps whose ancestor chain contains the owning group. Pinned by a
deterministic live-DB integration test (descendant inherits, sibling
subtree does not, app shadows by identical binding, non-identical coexists).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/src/groups_api.rs

@@ -22,6 +22,8 @@ use serde::{Deserialize, Serialize};
 use serde_json::json;
 use uuid::Uuid;
 
+use picloud_orchestrator_core::routing::RouteTable;
+
 use crate::admin_user_repo::{AdminUserRepository, AdminUserRow};
 use crate::app_repo::AppRepository;
 use crate::authz::{require, AuthzDenied, AuthzError, AuthzRepo, Capability};
@@ -29,6 +31,7 @@ use crate::group_members_repo::{
     GroupMembersRepository, GroupMembersRepositoryError, GroupMembershipDetail, GroupMembershipRow,
 };
 use crate::group_repo::{GroupRepository, GroupRepositoryError};
+use crate::route_repo::RouteRepository;
 
 const SLUG_MAX: usize = 63;
 const RESERVED_SLUGS: &[&str] = &[
@@ -42,6 +45,11 @@ pub struct GroupsState {
     pub apps: Arc<dyn AppRepository>,
     pub users: Arc<dyn AdminUserRepository>,
     pub authz: Arc<dyn AuthzRepo>,
+    /// §11 tail full-live invalidation: reparenting a group moves a whole
+    /// subtree, changing which ancestor-group route TEMPLATES its descendant
+    /// apps inherit — so the route snapshot is rebuilt after a reparent.
+    pub routes: Arc<dyn RouteRepository>,
+    pub route_table: Arc<RouteTable>,
 }
 
 pub fn groups_router(state: GroupsState) -> Router {
@@ -280,6 +288,13 @@ async fn reparent_group(
         }
     };
     let moved = s.groups.reparent(group.id, new_parent).await?;
+    // §11 tail: the moved subtree now inherits a different set of ancestor-group
+    // route TEMPLATES — rebuild the snapshot (best-effort; self-heals on the
+    // next route write or restart if it fails).
+    if let Err(e) = crate::route_admin::rebuild_route_table(s.routes.as_ref(), &s.route_table).await
+    {
+        tracing::warn!(error = %e, "groups: route table refresh after reparent failed; it will self-heal");
+    }
     Ok(Json(moved))
 }