feat(cli): [project] manifest block, --takeover, groups ls owner column

Makes §7 ownership usable end to end from the CLI.

- manifest: a `[project]` block (slug + optional name), independent of the
  [app]/[group] XOR; threaded onto every apply from the repo. --dir reads it
  from the tree ROOT's picloud.toml (a [project] elsewhere is ignored with a
  note).
- client: apply_node/apply_tree carry project + takeover; the 409 branch now
  surfaces the server message verbatim (covers StateMoved AND OwnershipConflict,
  both self-contained). New groups_list_with_owner captures the owner slug.
- pic apply --takeover flag; pic groups ls gains an `owner` column (the owning
  project's slug, or — when unclaimed).
- server: /api/v1/admin/groups now returns each group flattened with its owner
  slug (via list_with_owner) — the shared Group deserialize ignores the extra
  field, so pic groups tree / the dashboard are unaffected.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/cmds/groups.rs

@@ -16,19 +16,24 @@ use crate::output::{KvBlock, OutputMode, Table};
 pub async fn ls(mode: OutputMode) -> Result<()> {
     let creds = config::resolve()?;
     let client = Client::from_creds(&creds)?;
-    let groups = client.groups_list().await?;
-    let mut table = Table::new(["slug", "name", "parent", "created_at"]);
-    let by_id: BTreeMap<_, _> = groups.iter().map(|g| (g.id, g.slug.clone())).collect();
+    let groups = client.groups_list_with_owner().await?;
+    let mut table = Table::new(["slug", "name", "parent", "owner", "created_at"]);
+    let by_id: BTreeMap<_, _> = groups
+        .iter()
+        .map(|g| (g.group.id, g.group.slug.clone()))
+        .collect();
     for g in &groups {
         let parent = g
+            .group
             .parent_id
             .and_then(|p| by_id.get(&p).cloned())
             .unwrap_or_else(|| "-".into());
         table.row([
-            g.slug.clone(),
-            g.name.clone(),
+            g.group.slug.clone(),
+            g.group.name.clone(),
             parent,
-            g.created_at.to_rfc3339(),
+            g.owner.clone().unwrap_or_else(|| "—".into()),
+            g.group.created_at.to_rfc3339(),
         ]);
     }
     table.print(mode);