feat(stateful-templates): materialize cron+queue templates + hooks (M5.2-M5.4)

materialize::rematerialize_stateful_templates reconciles a group cron/queue
template into one app-owned copy per descendant (materialized_from = template),
via the all-apps app_chain CTE ⋈ group-owned stateful templates. A precise
create/delete diff preserves cron last_fired_at on unchanged copies; a queue
copy is skipped-with-warning when the app already fills that queue's consumer
slot (the one-consumer invariant). Called full-live at the route-rebuild
chokepoints: apply (single + tree), app create/delete (apps_api), group
reparent (groups_api) — AppsState/GroupsState gain a pool. Pinned by
tests/stateful_templates.rs (per-app copy, idempotent, new-app materializes,
reparent de-materializes).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud/src/lib.rs

@@ -573,6 +573,7 @@ pub async fn build_app(
         route_table: route_table.clone(),
         authz: authz.clone(),
         groups: groups_repo.clone(),
+        pool: pool.clone(),
     };
 
     // Audit 2026-06-11 H-B1 — login DoS defenses. PICLOUD_LOGIN_ARGON2_PARALLELISM
@@ -620,6 +621,7 @@ pub async fn build_app(
         authz: authz.clone(),
         routes: route_repo.clone(),
         route_table: route_table.clone(),
+        pool: pool.clone(),
     };
     let vars_state = VarsApiState {
         vars: Arc::new(PostgresVarsRepo::new(pool.clone())),