feat(cli): [group] manifest + pic plan/apply for a group node (Phase 5 C2)

Phase 5 C2. A `picloud.toml` can now declare a `[group]` node (instead of
`[app]`): the group's own scripts + `[vars]` (+ secret names). `pic plan` /
`pic apply` reconcile it via the C1 group endpoints — the same plan/apply/
bound-token flow as an app, routed by node kind.

  * `Manifest` is now app-XOR-group: `app`/`group` are both optional with an
    exactly-one check in `parse`, plus a group-node guard that rejects
    `[[routes]]`/`[[triggers]]` (those bind to an app). Accessors `slug()` /
    `is_group()` replace the hardcoded `manifest.app.slug`.
  * `client`: `plan_node`/`apply_node` take a `NodeKind { App | Group }` that
    selects the `apps` vs `groups` API path; the old `plan`/`apply` wrappers
    are gone (callers pass the kind).
  * `pic plan`/`apply` detect the node kind from the manifest and label output
    `group`/`app`; `pic config --effective` cleanly rejects a group manifest
    (effective config is an app's inherited view).

Live-validated: a `[group]` manifest with a script + var → `pic plan` (script
+ var creates) → `pic apply` (group-owned) → idempotent re-plan noop →
`pic scripts ls --group` shows it. Manifest unit test for group parse +
app-only-block rejection; init/pull/plan/apply/overlay journeys all green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/cmds/apply.rs

@@ -8,7 +8,7 @@ use std::path::Path;
 
 use anyhow::{Context, Result};
 
-use crate::client::Client;
+use crate::client::{Client, NodeKind};
 use crate::cmds::plan::build_bundle;
 use crate::config;
 use crate::manifest::Manifest;
@@ -28,36 +28,38 @@ pub async fn run(
     let manifest = Manifest::load_with_env(manifest_path, env)?;
     let base_dir = manifest_path.parent().unwrap_or_else(|| Path::new("."));
     let bundle = build_bundle(&manifest, base_dir)?;
+    let kind = if manifest.is_group() {
+        NodeKind::Group
+    } else {
+        NodeKind::App
+    };
+    let slug = manifest.slug().to_string();
 
     if prune && !yes {
-        confirm_prune(&manifest.app.slug)?;
+        confirm_prune(&slug)?;
     }
 
     // Bound-plan check: replay the token from the last `pic plan` (for this
-    // app) so the server refuses if the app changed since it was reviewed.
+    // node) so the server refuses if it changed since it was reviewed.
     // `--force` skips it; no recorded plan means no check (apply still works
     // standalone). The token is single-use — cleared after a successful apply.
     let expected_token = if force {
         None
     } else {
         crate::linkstate::read_plan(base_dir)
-            .filter(|l| l.app == manifest.app.slug)
+            .filter(|l| l.app == slug)
             .map(|l| l.state_token)
     };
 
     let report = client
-        .apply(
-            &manifest.app.slug,
-            &bundle,
-            prune,
-            expected_token.as_deref(),
-        )
+        .apply_node(kind, &slug, &bundle, prune, expected_token.as_deref())
         .await?;
-    crate::linkstate::clear_plan(base_dir, &manifest.app.slug);
+    crate::linkstate::clear_plan(base_dir, &slug);
 
+    let label = if manifest.is_group() { "group" } else { "app" };
     let mut block = KvBlock::new();
     block
-        .field("app", manifest.app.slug.clone())
+        .field(label, slug.clone())
         .field(
             "scripts",
             format!(