feat(cli): [project] manifest block, --takeover, groups ls owner column

Makes §7 ownership usable end to end from the CLI.

- manifest: a `[project]` block (slug + optional name), independent of the
  [app]/[group] XOR; threaded onto every apply from the repo. --dir reads it
  from the tree ROOT's picloud.toml (a [project] elsewhere is ignored with a
  note).
- client: apply_node/apply_tree carry project + takeover; the 409 branch now
  surfaces the server message verbatim (covers StateMoved AND OwnershipConflict,
  both self-contained). New groups_list_with_owner captures the owner slug.
- pic apply --takeover flag; pic groups ls gains an `owner` column (the owning
  project's slug, or — when unclaimed).
- server: /api/v1/admin/groups now returns each group flattened with its owner
  slug (via list_with_owner) — the shared Group deserialize ignores the extra
  field, so pic groups tree / the dashboard are unaffected.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/cmds/apply.rs

@@ -20,6 +20,7 @@ pub async fn run(
     prune: bool,
     yes: bool,
     force: bool,
+    takeover: bool,
     mode: OutputMode,
 ) -> Result<()> {
     let creds = config::resolve()?;
@@ -52,7 +53,15 @@ pub async fn run(
     };
 
     let report = client
-        .apply_node(kind, &slug, &bundle, prune, expected_token.as_deref())
+        .apply_node(
+            kind,
+            &slug,
+            &bundle,
+            prune,
+            manifest.project.as_ref(),
+            takeover,
+            expected_token.as_deref(),
+        )
         .await?;
     crate::linkstate::clear_plan(base_dir, &slug);
 
@@ -120,12 +129,13 @@ pub async fn run_tree(
     prune: bool,
     yes: bool,
     force: bool,
+    takeover: bool,
     env: Option<&str>,
     mode: OutputMode,
 ) -> Result<()> {
     let creds = config::resolve()?;
     let client = Client::from_creds(&creds)?;
-    let (bundle, node_count) = crate::discover::build_tree(dir, env)?;
+    let (bundle, node_count, project) = crate::discover::build_tree(dir, env)?;
 
     if prune && !yes {
         confirm_prune(&format!("{node_count} node(s) under {}", dir.display()))?;
@@ -141,7 +151,13 @@ pub async fn run_tree(
     };
 
     let report = client
-        .apply_tree(&bundle, prune, expected_token.as_deref())
+        .apply_tree(
+            &bundle,
+            prune,
+            project.as_ref(),
+            takeover,
+            expected_token.as_deref(),
+        )
         .await?;
     crate::linkstate::clear_plan(dir, token_key);