feat(secrets): group-secrets admin API, masked read, config/effective

Adds the Phase-3 admin surface on top of the group-secrets storage:

* `secrets_api` gains group routes under `/groups/{id}/secrets`
  (set/list/delete, env-scoped) gated `GroupSecretsWrite` (editor+), plus
  the ONE plaintext endpoint `GET /groups/{id}/secrets/{name}/value` gated
  `GroupSecretsRead` (group_admin only). That is the masked-secret
  boundary: a descendant app's dev sees a group secret EXISTS and consumes
  it at runtime via `secrets::get`, but only a reader at the OWNING group
  gets the value. App secrets stay env-agnostic (a stray `env` is rejected).
  The owner is resolved first, then the capability binds to the resolved
  id — never a path param.

* `config_api`: `GET /apps/{id}/config/effective` (gated `AppVarsRead`)
  returns the resolved view a dev would get — every inherited var with its
  value + provenance, and every inherited secret MASKED (name/owner/scope,
  never the value). Backed by a new `fetch_effective_secret_meta`
  (DISTINCT-ON nearest-wins, same ordering as the per-name resolver).

* authz: `GroupSecretsWrite` moves from `app:admin` to `script:write`
  scope so its API-key scope matches its editor role tier (closing the
  latent scope/role mismatch the checkpoint review flagged); the value
  read `GroupSecretsRead` stays at `app:admin`.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud/src/lib.rs

@@ -513,6 +513,7 @@ pub async fn build_app(
     let secrets_state = SecretsState {
         repo: secrets_repo,
         apps: apps_repo.clone(),
+        groups: groups_repo.clone(),
         authz: authz.clone(),
         master_key,
         max_value_bytes: secrets_max_value_bytes,
@@ -576,6 +577,11 @@ pub async fn build_app(
         groups: groups_repo.clone(),
         authz: authz.clone(),
     };
+    let config_state = picloud_manager_core::ConfigApiState {
+        pool: pool.clone(),
+        apps: apps_repo.clone(),
+        authz: authz.clone(),
+    };
     let app_users_admin_state = picloud_manager_core::AppUsersState {
         apps: apps_state.apps.clone(),
         authz: authz.clone(),
@@ -600,6 +606,7 @@ pub async fn build_app(
         .merge(app_members_router(app_members_state))
         .merge(groups_router(groups_state))
         .merge(vars_router(vars_state))
+        .merge(picloud_manager_core::config_router(config_state))
         .merge(picloud_manager_core::app_users_router(
             app_users_admin_state,
         ))