feat(cli): pic routes ls --group + group-route journey + docs (§11 tail R5)

Visibility + end-to-end coverage + docs for group route templates.

- ApplyService::route_report(Group) → GET /api/v1/admin/groups/{id}/routes
  (viewer-tier GroupScriptsRead), surfacing a group's own route templates
  (method, host, path, handler script, dispatch, enabled).
- CLI: `pic routes ls --group <g>` (the script-id positional now conflicts
  with --group), client `group_routes_list` + RouteTemplateDto.
- Journey `group_routes.rs`: a group declares a `[[routes]]` template
  binding a group handler; a DESCENDANT app serves it (via `routes match`
  against the live RouteTable), a SIBLING-subtree app does not, `routes ls
  --group` shows it, re-apply is a NoOp. Shadowing + isolation are
  additionally pinned at the repo layer by group_route_templates.rs.
- Update the manifest unit test: a [group] now accepts route templates and
  rejects only the stateful trigger kinds.
- Docs: design §4.5 (the live route-template model + full-live
  invalidation + nearest-wins shadowing + deferrals), CLAUDE.md focus.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/cmds/routes.rs

@@ -35,6 +35,37 @@ pub async fn ls(script_id: &str, mode: OutputMode) -> Result<()> {
     Ok(())
 }
 
+/// `pic routes ls --group <g>` — read-only view of a group's §11 tail route
+/// TEMPLATES (inherited live by every descendant app). Authoring is declarative
+/// via the `[group]` manifest `[[routes]]`.
+pub async fn ls_group(group: &str, mode: OutputMode) -> Result<()> {
+    let creds = config::resolve()?;
+    let client = Client::from_creds(&creds)?;
+    let rows = client.group_routes_list(group).await?;
+    let mut table = Table::new([
+        "method",
+        "host",
+        "path_kind",
+        "path",
+        "script",
+        "dispatch",
+        "enabled",
+    ]);
+    for r in rows {
+        table.row([
+            r.method,
+            r.host,
+            r.path_kind,
+            r.path,
+            r.script,
+            r.dispatch,
+            r.enabled.to_string(),
+        ]);
+    }
+    table.print(mode);
+    Ok(())
+}
+
 #[allow(clippy::too_many_arguments)]
 pub async fn create(
     script_id: &str,