test(cli): shared-files journey + .gitignore + docs (§11.6 files C5)

- collections.rs: shared_files_collection_is_read_write_across_the_subtree
  — a group declares kv+docs+files in one string-or-table manifest; authed
  app A creates a blob via files::shared_collection("assets").create(...),
  app B lists + gets the SAME bytes back across the subtree, a
  sibling-subtree app gets CollectionNotShared, collections ls shows all
  three kinds. Live-verified the bytes land under
  files/groups/<group_id>/assets/<id[0:2]>/<id>.
- .gitignore: ignore /crates/picloud-cli/data (the CLI journey harness
  spawns the server from that dir; the files journey is the first CLI test
  to write blobs).
- docs: design §11.6 (KV+DOCS+FILES shipped; topics/queue still deferred),
  sdk-shape (files::shared_collection), CLAUDE.md current-focus.

Full journey suite 117/117; schema blessed (55 migrations); workspace
clippy -D clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/sdk-shape.md

@@ -99,14 +99,18 @@ script. **Reads** are open to any subtree script (including anonymous
 public endpoints — declaring the collection *is* the grant); **writes**
 require an authenticated principal with editor+ on the owning group.
 
-**Docs too.** The same handle exists for the queryable-JSON store:
-`docs::shared_collection("articles")` returns a shared-docs handle with the
-full `create`/`get`/`find`/`find_one`/`update`/`delete`/`list` surface (same
-trust model + isolation boundary as the KV one). A `[group]` declares a
+**Docs and files too.** The same handle exists for the queryable-JSON store
+and the blob store: `docs::shared_collection("articles")` returns a shared-docs
+handle with the full `create`/`get`/`find`/`find_one`/`update`/`delete`/`list`
+surface, and `files::shared_collection("assets")` returns a shared-files handle
+with `create`/`head`/`get`/`update`/`delete`/`list` (Blob in/out) — both with
+the same trust model + isolation boundary as the KV one. A `[group]` declares a
 collection's store with a kind: `collections = ["catalog", { name =
-"articles", kind = "docs" }]` — a bare string is `kv`, a `{ name, kind }`
-table sets it. A `kv` and a `docs` collection of the same name are distinct
-stores. (Files/topics/queue shared collections are not yet implemented.)
+"articles", kind = "docs" }, { name = "assets", kind = "files" }]` — a bare
+string is `kv`, a `{ name, kind }` table sets it (`kv`/`docs`/`files`). A `kv`,
+a `docs`, and a `files` collection of the same name are distinct stores; group
+blobs live on disk under `<root>/files/groups/<group_id>/...`. (Topics/queue
+shared collections are not yet implemented.)
 
 ## Error convention