feat(cli): pic routes ls --group + group-route journey + docs (§11 tail R5)

Visibility + end-to-end coverage + docs for group route templates.

- ApplyService::route_report(Group) → GET /api/v1/admin/groups/{id}/routes
  (viewer-tier GroupScriptsRead), surfacing a group's own route templates
  (method, host, path, handler script, dispatch, enabled).
- CLI: `pic routes ls --group <g>` (the script-id positional now conflicts
  with --group), client `group_routes_list` + RouteTemplateDto.
- Journey `group_routes.rs`: a group declares a `[[routes]]` template
  binding a group handler; a DESCENDANT app serves it (via `routes match`
  against the live RouteTable), a SIBLING-subtree app does not, `routes ls
  --group` shows it, re-apply is a NoOp. Shadowing + isolation are
  additionally pinned at the repo layer by group_route_templates.rs.
- Update the manifest unit test: a [group] now accepts route templates and
  rejects only the stateful trigger kinds.
- Docs: design §4.5 (the live route-template model + full-live
  invalidation + nearest-wins shadowing + deferrals), CLAUDE.md focus.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/src/apply_service.rs

@@ -472,6 +472,21 @@ pub struct TriggerTemplateInfo {
     pub enabled: bool,
 }
 
+/// One row of the read-only §11 tail route-template report (`pic routes ls
+/// --group`). The binding tuple a descendant app inherits, plus the handler
+/// script's name. The stored route `name` is a UUID for reconcile-created
+/// rows, so the semantic bits are shown instead.
+#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
+pub struct RouteTemplateInfo {
+    pub method: String,
+    pub host: String,
+    pub path_kind: String,
+    pub path: String,
+    pub script: String,
+    pub dispatch: String,
+    pub enabled: bool,
+}
+
 // ----------------------------------------------------------------------------
 // Errors
 // ----------------------------------------------------------------------------
@@ -1935,6 +1950,46 @@ impl ApplyService {
             .collect())
     }
 
+    /// Read-only §11 tail report: a group's own route TEMPLATES, surfaced as
+    /// the inherited binding tuple + handler script name. Backs
+    /// `pic routes ls --group`.
+    pub async fn route_report(
+        &self,
+        owner: ApplyOwner,
+    ) -> Result<Vec<RouteTemplateInfo>, ApplyError> {
+        let ApplyOwner::Group(group_id) = owner else {
+            return Ok(Vec::new());
+        };
+        let routes = self
+            .routes
+            .list_for_group(group_id)
+            .await
+            .map_err(|e| ApplyError::Backend(e.to_string()))?;
+        let scripts = self
+            .scripts
+            .list_for_group(group_id)
+            .await
+            .map_err(|e| ApplyError::Backend(e.to_string()))?;
+        let name_by_id: HashMap<ScriptId, String> =
+            scripts.iter().map(|s| (s.id, s.name.clone())).collect();
+        Ok(routes
+            .into_iter()
+            .map(|r| RouteTemplateInfo {
+                method: r.method.clone().unwrap_or_else(|| "ANY".into()),
+                host: match r.host_kind {
+                    HostKind::Any => "any".to_string(),
+                    HostKind::Strict => format!("strict:{}", r.host),
+                    HostKind::Wildcard => format!("*.{}", r.host),
+                },
+                path_kind: path_kind_str(r.path_kind).to_string(),
+                path: r.path.clone(),
+                script: name_by_id.get(&r.script_id).cloned().unwrap_or_default(),
+                dispatch: r.dispatch_mode.as_str().to_string(),
+                enabled: r.enabled,
+            })
+            .collect())
+    }
+
     pub async fn collection_report(
         &self,
         owner: ApplyOwner,