feat(cli): pic routes ls --group + group-route journey + docs (§11 tail R5)

Visibility + end-to-end coverage + docs for group route templates.

- ApplyService::route_report(Group) → GET /api/v1/admin/groups/{id}/routes
  (viewer-tier GroupScriptsRead), surfacing a group's own route templates
  (method, host, path, handler script, dispatch, enabled).
- CLI: `pic routes ls --group <g>` (the script-id positional now conflicts
  with --group), client `group_routes_list` + RouteTemplateDto.
- Journey `group_routes.rs`: a group declares a `[[routes]]` template
  binding a group handler; a DESCENDANT app serves it (via `routes match`
  against the live RouteTable), a SIBLING-subtree app does not, `routes ls
  --group` shows it, re-apply is a NoOp. Shadowing + isolation are
  additionally pinned at the repo layer by group_route_templates.rs.
- Update the manifest unit test: a [group] now accepts route templates and
  rejects only the stateful trigger kinds.
- Docs: design §4.5 (the live route-template model + full-live
  invalidation + nearest-wins shadowing + deferrals), CLAUDE.md focus.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/manifest.rs

@@ -762,13 +762,22 @@ mod tests {
         assert_eq!(m.slug(), "acme");
         assert_eq!(m.scripts.len(), 1);
 
-        // A group cannot carry routes/triggers.
-        let err = Manifest::parse(
+        // §11 tail: a group MAY carry ROUTE templates (inherited by descendants).
+        let routed = Manifest::parse(
             "[group]\nslug = \"acme\"\nname = \"ACME\"\n\n\
              [[routes]]\nscript = \"shared\"\nhost_kind = \"any\"\npath_kind = \"exact\"\npath = \"/x\"\n",
         )
-        .expect_err("group with routes is rejected");
-        assert!(err.to_string().contains("routes"), "got: {err}");
+        .expect("group with a route template parses");
+        assert!(routed.is_group());
+        assert_eq!(routed.routes.len(), 1);
+
+        // ...but a STATEFUL trigger kind (cron/queue/email) on a group is rejected.
+        let err = Manifest::parse(
+            "[group]\nslug = \"acme\"\nname = \"ACME\"\n\n\
+             [[triggers.cron]]\nscript = \"shared\"\nschedule = \"0 0 * * * *\"\n",
+        )
+        .expect_err("group with a cron trigger is rejected");
+        assert!(err.to_string().contains("event kind"), "got: {err}");
 
         // Neither / both is rejected.
         Manifest::parse("[vars]\nx = 1\n").expect_err("no [app] or [group]");