feat(cli): pic routes ls --group + group-route journey + docs (§11 tail R5)

Visibility + end-to-end coverage + docs for group route templates.

- ApplyService::route_report(Group) → GET /api/v1/admin/groups/{id}/routes
  (viewer-tier GroupScriptsRead), surfacing a group's own route templates
  (method, host, path, handler script, dispatch, enabled).
- CLI: `pic routes ls --group <g>` (the script-id positional now conflicts
  with --group), client `group_routes_list` + RouteTemplateDto.
- Journey `group_routes.rs`: a group declares a `[[routes]]` template
  binding a group handler; a DESCENDANT app serves it (via `routes match`
  against the live RouteTable), a SIBLING-subtree app does not, `routes ls
  --group` shows it, re-apply is a NoOp. Shadowing + isolation are
  additionally pinned at the repo layer by group_route_templates.rs.
- Update the manifest unit test: a [group] now accepts route templates and
  rejects only the stateful trigger kinds.
- Docs: design §4.5 (the live route-template model + full-live
  invalidation + nearest-wins shadowing + deferrals), CLAUDE.md focus.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/main.rs

@@ -821,8 +821,14 @@ impl From<InstanceRoleArg> for picloud_shared::InstanceRole {
 
 #[derive(Subcommand)]
 enum RoutesCmd {
-    /// List routes bound to a script.
-    Ls { script_id: String },
+    /// List routes bound to a script, or a group's route TEMPLATES (`--group`).
+    Ls {
+        #[arg(conflicts_with = "group", required_unless_present = "group")]
+        script_id: Option<String>,
+        /// List the group's §11 tail route templates instead.
+        #[arg(long)]
+        group: Option<String>,
+    },
 
     /// Create a new route. Host defaults to `*` (any). Path-kind
     /// defaults to `exact`. Dispatch defaults to `sync`.
@@ -1608,8 +1614,12 @@ async fn main() -> ExitCode {
             Err(e) => Err(e),
         },
         Cmd::Routes {
-            cmd: RoutesCmd::Ls { script_id },
-        } => cmds::routes::ls(&script_id, mode).await,
+            cmd: RoutesCmd::Ls { script_id, group },
+        } => match (script_id, group) {
+            (_, Some(group)) => cmds::routes::ls_group(&group, mode).await,
+            (Some(script_id), None) => cmds::routes::ls(&script_id, mode).await,
+            (None, None) => Err(anyhow::anyhow!("provide a script id or --group")),
+        },
         Cmd::Routes {
             cmd:
                 RoutesCmd::Create {