feat(routes): live group-route expansion + full-live invalidation (§11 tail R3)

The runtime half. Group route TEMPLATES now expand into every descendant
app's in-memory match slice, live, with no per-app materialization.

- `compile_effective_routes` consumes the `list_effective` expansion and
  applies NEAREST-OWNER-WINS shadowing: for one app, identical binding
  tuples (method+host+path) owned at multiple chain levels collapse to the
  nearest (an app's own route shadows an ancestor-group template); a nearer
  group beats a farther one. Non-identical bindings coexist and the
  existing matcher precedence resolves each request. `compile_route` now
  takes the effective app_id, so the matcher + dispatch are unchanged.
- `rebuild_route_table` is the single refresh chokepoint (list_effective →
  compile_effective_routes → replace_all). Route CRUD, the apply reconcile,
  and startup all route through it; the apply guards drop the "a group node
  touches no routes" assumption (a group apply may now create templates).
- FULL-LIVE INVALIDATION: app create/delete (apps_api) and group reparent
  (groups_api) rebuild the snapshot, so inherited routes take effect the
  instant the tree changes — matching the live model of triggers/vars.
  Best-effort, mirroring apply: a failed rebuild self-heals on the next
  write or restart, never failing the committed mutation.

The isolation boundary is the chain expansion: a template lands only in the
slices of apps whose ancestor chain contains the owning group. Pinned by a
deterministic live-DB integration test (descendant inherits, sibling
subtree does not, app shadows by identical binding, non-identical coexists).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/src/route_admin.rs

@@ -20,7 +20,7 @@ use uuid::Uuid;
 use crate::app_domain_repo::AppDomainRepository;
 use crate::authz::{require, AuthzDenied, AuthzRepo, Capability};
 use crate::repo::{ScriptRepository, ScriptRepositoryError};
-use crate::route_repo::{NewRoute, RouteRepository};
+use crate::route_repo::{EffectiveRoute, NewRoute, RouteRepository};
 
 pub struct RouteAdminState<RR, SR> {
     pub routes: Arc<RR>,
@@ -388,9 +388,26 @@ fn first_conflict(
 async fn refresh_table<RR: RouteRepository, SR: ScriptRepository>(
     state: &RouteAdminState<RR, SR>,
 ) -> Result<(), RouteApiError> {
-    let rows = state.routes.list_all().await?;
-    let compiled = compile_routes(&rows);
-    state.table.replace_all(compiled);
+    rebuild_route_table(state.routes.as_ref(), &state.table).await?;
+    Ok(())
+}
+
+/// Rebuild the entire in-memory [`RouteTable`] from the database, expanding
+/// §11 tail group route TEMPLATES into every descendant app's slice.
+///
+/// This is the single chokepoint for route-table refresh — called from route
+/// CRUD, the declarative apply reconcile, startup, and (full-live invalidation)
+/// every tree mutation that changes inheritance (app create/reparent/delete,
+/// group reparent). It reads the live expansion (`list_effective`) so a group
+/// template lands in the slice of each app whose ancestor chain contains the
+/// owning group, and nowhere else — the chain walk is the isolation boundary.
+pub async fn rebuild_route_table(
+    routes: &dyn RouteRepository,
+    table: &RouteTable,
+) -> Result<(), ScriptRepositoryError> {
+    let effective = routes.list_effective().await?;
+    let compiled = compile_effective_routes(&effective);
+    table.replace_all(compiled);
     Ok(())
 }
 
@@ -423,6 +440,59 @@ pub fn compile_routes(rows: &[Route]) -> Vec<CompiledRoute> {
         .collect()
 }
 
+/// Compile the §11 tail effective expansion into per-app match slices, applying
+/// **nearest-owner-wins shadowing**: for a given app, if the same binding tuple
+/// (method + host + path) is owned at more than one chain level — e.g. the app
+/// declares its own `/x` and an ancestor group also templates `/x` — the
+/// nearest owner (lowest `depth`) wins and the farther one is dropped. Unlike
+/// triggers (which fan out to every match), a route resolves to a single
+/// winner, so identical bindings MUST dedupe; **non-identical** bindings (the
+/// app's `/users/:id` + the group's `/users/admin`) coexist and the matcher's
+/// existing precedence picks per request.
+///
+/// Requires `rows` ordered by `(effective_app_id, depth ASC)` — which
+/// [`RouteRepository::list_effective`] guarantees — so first-seen is nearest.
+#[must_use]
+pub fn compile_effective_routes(rows: &[EffectiveRoute]) -> Vec<CompiledRoute> {
+    let mut seen: std::collections::HashSet<(AppId, String)> = std::collections::HashSet::new();
+    let mut out = Vec::new();
+    for er in rows {
+        if !er.route.enabled {
+            continue;
+        }
+        // A nearer owner already claimed this binding for this app → shadow.
+        if !seen.insert((er.effective_app_id, binding_key(&er.route))) {
+            continue;
+        }
+        if let Some(compiled) = compile_one(&er.route, er.effective_app_id) {
+            out.push(compiled);
+        }
+    }
+    out
+}
+
+/// The shadow-identity of a route within one app's slice: the binding tuple a
+/// request resolves against (method + host + path), matching the per-owner DB
+/// unique index. Two routes with the same key are "the same endpoint" and only
+/// the nearest owner's survives.
+fn binding_key(r: &Route) -> String {
+    let method = r
+        .method
+        .as_deref()
+        .map_or("ANY".to_string(), str::to_uppercase);
+    let host_kind = match r.host_kind {
+        HostKind::Any => "any",
+        HostKind::Strict => "strict",
+        HostKind::Wildcard => "wildcard",
+    };
+    let path_kind = match r.path_kind {
+        PathKind::Exact => "exact",
+        PathKind::Prefix => "prefix",
+        PathKind::Param => "param",
+    };
+    format!("{method} {host_kind} {} {path_kind} {}", r.host, r.path)
+}
+
 /// Parse one stored route into a `CompiledRoute` bound to `app_id` (the
 /// effective app — its own for app routes, the firing descendant for a group
 /// template). Lenient: an un-compilable row is skipped-with-warning, never an