feat(cli): [project] manifest block, --takeover, groups ls owner column

Makes §7 ownership usable end to end from the CLI.

- manifest: a `[project]` block (slug + optional name), independent of the
  [app]/[group] XOR; threaded onto every apply from the repo. --dir reads it
  from the tree ROOT's picloud.toml (a [project] elsewhere is ignored with a
  note).
- client: apply_node/apply_tree carry project + takeover; the 409 branch now
  surfaces the server message verbatim (covers StateMoved AND OwnershipConflict,
  both self-contained). New groups_list_with_owner captures the owner slug.
- pic apply --takeover flag; pic groups ls gains an `owner` column (the owning
  project's slug, or — when unclaimed).
- server: /api/v1/admin/groups now returns each group flattened with its owner
  slug (via list_with_owner) — the shared Group deserialize ignores the extra
  field, so pic groups tree / the dashboard are unaffected.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/src/groups_api.rs

@@ -158,11 +158,28 @@ pub struct PatchMemberRequest {
 /// any authenticated admin sees the full tree; per-action authz still
 /// gates every mutation and all app access. Tighten in Phase 3 when groups
 /// carry inheritable config.
+/// §7: a group plus its owning project's slug (`None` = unclaimed / UI-owned).
+/// The group fields are flattened, so existing consumers (dashboard, `pic
+/// groups tree`) keep working; `owner` is a new, optional field.
+#[derive(Serialize)]
+struct GroupListItem {
+    #[serde(flatten)]
+    group: Group,
+    owner: Option<String>,
+}
+
 async fn list_groups(
     State(s): State<GroupsState>,
     Extension(_principal): Extension<Principal>,
-) -> Result<Json<Vec<Group>>, GroupsApiError> {
-    Ok(Json(s.groups.list().await?))
+) -> Result<Json<Vec<GroupListItem>>, GroupsApiError> {
+    let items = s
+        .groups
+        .list_with_owner()
+        .await?
+        .into_iter()
+        .map(|(group, owner)| GroupListItem { group, owner })
+        .collect();
+    Ok(Json(items))
 }
 
 async fn create_group(