feat(cli): pic routes ls --group + group-route journey + docs (§11 tail R5)

Visibility + end-to-end coverage + docs for group route templates.

- ApplyService::route_report(Group) → GET /api/v1/admin/groups/{id}/routes
  (viewer-tier GroupScriptsRead), surfacing a group's own route templates
  (method, host, path, handler script, dispatch, enabled).
- CLI: `pic routes ls --group <g>` (the script-id positional now conflicts
  with --group), client `group_routes_list` + RouteTemplateDto.
- Journey `group_routes.rs`: a group declares a `[[routes]]` template
  binding a group handler; a DESCENDANT app serves it (via `routes match`
  against the live RouteTable), a SIBLING-subtree app does not, `routes ls
  --group` shows it, re-apply is a NoOp. Shadowing + isolation are
  additionally pinned at the repo layer by group_route_templates.rs.
- Update the manifest unit test: a [group] now accepts route templates and
  rejects only the stateful trigger kinds.
- Docs: design §4.5 (the live route-template model + full-live
  invalidation + nearest-wins shadowing + deferrals), CLAUDE.md focus.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/client.rs

@@ -1360,6 +1360,17 @@ impl Client {
             .await?;
         decode(resp).await
     }
+
+    /// `GET /api/v1/admin/groups/{ident}/routes` (§11 tail). Group-only — route
+    /// templates are declared on groups and inherited by descendant apps.
+    pub async fn group_routes_list(&self, group_ident: &str) -> Result<Vec<RouteTemplateDto>> {
+        let ident = seg(group_ident);
+        let resp = self
+            .request(Method::GET, &format!("/api/v1/admin/groups/{ident}/routes"))
+            .send()
+            .await?;
+        decode(resp).await
+    }
 }
 
 /// One row of the §11 tail trigger-template report.
@@ -1373,6 +1384,24 @@ pub struct TriggerTemplateDto {
     pub enabled: bool,
 }
 
+/// One row of the §11 tail route-template report.
+#[derive(Debug, Deserialize)]
+pub struct RouteTemplateDto {
+    #[serde(default)]
+    pub method: String,
+    #[serde(default)]
+    pub host: String,
+    #[serde(default)]
+    pub path_kind: String,
+    #[serde(default)]
+    pub path: String,
+    #[serde(default)]
+    pub script: String,
+    #[serde(default)]
+    pub dispatch: String,
+    pub enabled: bool,
+}
+
 /// One row of the §11.6 shared-collection report.
 #[derive(Debug, Deserialize)]
 pub struct CollectionInfoDto {