feat(groups): tree repos, hierarchy-aware RBAC, admin API

Server-side foundation for Phase-2 groups (no group-owned resources yet):

Shared types:
- GroupId, Group; App gains group_id; AppRole::{precedence,max} for
  folding the highest effective role across the membership chain.

Repos:
- group_repo: tree CRUD with reparent (ancestor-walk cycle guard under a
  coarse instance-wide structural advisory lock; slug frozen; bumps
  structure_version) and delete=RESTRICT (refuses non-empty groups).
- group_members_repo: per-(user, group) role grants, mirroring app_members.

Hierarchy-aware authz (§5.3):
- AuthzRepo gains effective_app_role / effective_group_role (default to
  direct membership / none, so the ~18 existing test stubs are untouched);
  the Postgres impl resolves each via one depth-bounded recursive CTE that
  MAXes the app's own row with every ancestor group_members row.
- can(): the Member path now folds inherited group roles, so a group_admin
  on any ancestor is implicitly app_admin beneath it. New Capability
  variants InstanceCreateGroup / Group{Read,Write,Admin}; group caps carry
  no app_id (bound API keys can't manage groups). 8 new unit tests.

Admin API:
- groups_api: group CRUD + reparent (admin at both source and destination
  parent, §5.6) + per-group members, all capability-gated.
- apps: POST /apps takes an optional parent group (default root); app
  responses carry group_id; my_role now reflects the effective role.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/src/topics_api.rs

@@ -383,6 +383,7 @@ mod tests {
                 slug: self.slug.clone(),
                 name: "test".into(),
                 description: None,
+                group_id: picloud_shared::GroupId::new(),
                 created_at: now,
                 updated_at: now,
             }
@@ -396,6 +397,12 @@ mod tests {
         async fn list_for_user(&self, _: AdminUserId) -> Result<Vec<App>, ScriptRepositoryError> {
             unimplemented!()
         }
+        async fn list_for_group(
+            &self,
+            _: picloud_shared::GroupId,
+        ) -> Result<Vec<App>, ScriptRepositoryError> {
+            unimplemented!()
+        }
         async fn get_by_id(&self, id: AppId) -> Result<Option<App>, ScriptRepositoryError> {
             if id != self.id {
                 return Ok(None);
@@ -436,6 +443,7 @@ mod tests {
             _: &str,
             _: &str,
             _: Option<&str>,
+            _: picloud_shared::GroupId,
         ) -> Result<App, ScriptRepositoryError> {
             unimplemented!()
         }
@@ -444,6 +452,7 @@ mod tests {
             _: &str,
             _: &str,
             _: Option<&str>,
+            _: picloud_shared::GroupId,
         ) -> Result<App, ScriptRepositoryError> {
             unimplemented!()
         }