feat(cli): pic routes ls --group + group-route journey + docs (§11 tail R5)

Visibility + end-to-end coverage + docs for group route templates.

- ApplyService::route_report(Group) → GET /api/v1/admin/groups/{id}/routes
  (viewer-tier GroupScriptsRead), surfacing a group's own route templates
  (method, host, path, handler script, dispatch, enabled).
- CLI: `pic routes ls --group <g>` (the script-id positional now conflicts
  with --group), client `group_routes_list` + RouteTemplateDto.
- Journey `group_routes.rs`: a group declares a `[[routes]]` template
  binding a group handler; a DESCENDANT app serves it (via `routes match`
  against the live RouteTable), a SIBLING-subtree app does not, `routes ls
  --group` shows it, re-apply is a NoOp. Shadowing + isolation are
  additionally pinned at the repo layer by group_route_templates.rs.
- Update the manifest unit test: a [group] now accepts route templates and
  rejects only the stateful trigger kinds.
- Docs: design §4.5 (the live route-template model + full-live
  invalidation + nearest-wins shadowing + deferrals), CLAUDE.md focus.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/src/apply_api.rs

@@ -18,7 +18,8 @@ use serde_json::json;
 use crate::app_repo::AppRepository;
 use crate::apply_service::{
     ApplyError, ApplyOwner, ApplyReport, ApplyService, Bundle, BundleTrigger, CollectionInfo,
-    ExtensionPointInfo, NodeKind, PlanResult, TreeBundle, TreePlanResult, TriggerTemplateInfo,
+    ExtensionPointInfo, NodeKind, PlanResult, RouteTemplateInfo, TreeBundle, TreePlanResult,
+    TriggerTemplateInfo,
 };
 use crate::authz::{require, AuthzDenied, Capability};
 use crate::group_repo::GroupRepository;
@@ -42,9 +43,30 @@ pub fn apply_router(service: ApplyService) -> Router {
         )
         .route("/groups/{id}/collections", get(group_collections_handler))
         .route("/groups/{id}/triggers", get(group_triggers_handler))
+        .route("/groups/{id}/routes", get(group_routes_handler))
         .with_state(service)
 }
 
+/// Read-only §11 tail route-template report for a group: its own declared route
+/// templates (method, host, path, handler script, dispatch, enabled). Viewer-
+/// tier read. Backs `pic routes ls --group`.
+async fn group_routes_handler(
+    State(svc): State<ApplyService>,
+    Extension(principal): Extension<Principal>,
+    Path(id_or_slug): Path<String>,
+) -> Result<Json<Vec<RouteTemplateInfo>>, ApplyError> {
+    let group_id = resolve_group_id(svc.groups.as_ref(), &id_or_slug).await?;
+    require(
+        svc.authz.as_ref(),
+        &principal,
+        Capability::GroupScriptsRead(group_id),
+    )
+    .await
+    .map_err(map_authz)?;
+    let report = svc.route_report(ApplyOwner::Group(group_id)).await?;
+    Ok(Json(report))
+}
+
 /// Read-only §11 tail trigger-template report for a group: its own declared
 /// event trigger templates (kind, target, handler script, enabled). Viewer-tier
 /// read. Backs `pic triggers ls --group`.

crates/manager-core/src/apply_service.rs

@@ -472,6 +472,21 @@ pub struct TriggerTemplateInfo {
     pub enabled: bool,
 }
 
+/// One row of the read-only §11 tail route-template report (`pic routes ls
+/// --group`). The binding tuple a descendant app inherits, plus the handler
+/// script's name. The stored route `name` is a UUID for reconcile-created
+/// rows, so the semantic bits are shown instead.
+#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
+pub struct RouteTemplateInfo {
+    pub method: String,
+    pub host: String,
+    pub path_kind: String,
+    pub path: String,
+    pub script: String,
+    pub dispatch: String,
+    pub enabled: bool,
+}
+
 // ----------------------------------------------------------------------------
 // Errors
 // ----------------------------------------------------------------------------
@@ -1935,6 +1950,46 @@ impl ApplyService {
             .collect())
     }
 
+    /// Read-only §11 tail report: a group's own route TEMPLATES, surfaced as
+    /// the inherited binding tuple + handler script name. Backs
+    /// `pic routes ls --group`.
+    pub async fn route_report(
+        &self,
+        owner: ApplyOwner,
+    ) -> Result<Vec<RouteTemplateInfo>, ApplyError> {
+        let ApplyOwner::Group(group_id) = owner else {
+            return Ok(Vec::new());
+        };
+        let routes = self
+            .routes
+            .list_for_group(group_id)
+            .await
+            .map_err(|e| ApplyError::Backend(e.to_string()))?;
+        let scripts = self
+            .scripts
+            .list_for_group(group_id)
+            .await
+            .map_err(|e| ApplyError::Backend(e.to_string()))?;
+        let name_by_id: HashMap<ScriptId, String> =
+            scripts.iter().map(|s| (s.id, s.name.clone())).collect();
+        Ok(routes
+            .into_iter()
+            .map(|r| RouteTemplateInfo {
+                method: r.method.clone().unwrap_or_else(|| "ANY".into()),
+                host: match r.host_kind {
+                    HostKind::Any => "any".to_string(),
+                    HostKind::Strict => format!("strict:{}", r.host),
+                    HostKind::Wildcard => format!("*.{}", r.host),
+                },
+                path_kind: path_kind_str(r.path_kind).to_string(),
+                path: r.path.clone(),
+                script: name_by_id.get(&r.script_id).cloned().unwrap_or_default(),
+                dispatch: r.dispatch_mode.as_str().to_string(),
+                enabled: r.enabled,
+            })
+            .collect())
+    }
+
     pub async fn collection_report(
         &self,
         owner: ApplyOwner,