feat(modules): GroupFilesService + files::shared_collection handle (§11.6 files C3)

- shared/group_files: GroupFilesService trait (mirror FilesService, no
  group id arg — owner resolved from cx.app_id), GroupFilesError (clone of
  FilesError + CollectionNotShared) with From<FilesError>, Noop.
- services: group_files field + with_group_files setter (default Noop).
- group_files_service: GroupFilesServiceImpl — owning_group via the
  registry resolver (kind=files) → CollectionNotShared; reads open
  (script_gate), writes fail closed (script_gate_require_principal);
  reuses validate_files_collection + the NewFile/FileUpdate validators +
  sanitize_stored_content_type + the per-file size cap; no events.
- sdk/files: GroupFilesHandle + files::shared_collection(name) + the
  create/head/get/update/delete/list group methods (Blob in/out).
- picloud: construct FsGroupFilesRepo (sharing the files root + size cap)
  + GroupFilesServiceImpl, .with_group_files(...).

Unit tests: off-chain → CollectionNotShared; anon read OK / anon write
Forbidden; oversize → TooLarge.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud/src/lib.rs

@@ -19,10 +19,10 @@ use picloud_manager_core::{
     AppDomainRepository, AppMembersRepository, AppMembersState, AppRepository, ApplyService,
     AppsState, AuthState, AuthzRepo, DeadLetterRepo, DeadLettersState, DevEmailState, Dispatcher,
     DocsServiceImpl, EmailInboundState, EmailServiceImpl, FilesAdminState, FilesConfig,
-    FilesServiceImpl, FsFilesRepo, GroupDocsServiceImpl, GroupKvServiceImpl,
-    GroupMembersRepository, GroupRepository, GroupsState, HttpConfig, HttpServiceImpl,
-    InboundNonceDedup, KvAdminState, KvServiceImpl, OutboxEventEmitter, OutboxRepo,
-    PostgresAbandonedRepo, PostgresAdminSessionRepository, PostgresAdminUserRepository,
+    FilesServiceImpl, FsFilesRepo, FsGroupFilesRepo, GroupDocsServiceImpl, GroupFilesServiceImpl,
+    GroupKvServiceImpl, GroupMembersRepository, GroupRepository, GroupsState, HttpConfig,
+    HttpServiceImpl, InboundNonceDedup, KvAdminState, KvServiceImpl, OutboxEventEmitter,
+    OutboxRepo, PostgresAbandonedRepo, PostgresAdminSessionRepository, PostgresAdminUserRepository,
     PostgresApiKeyRepository, PostgresAppDomainRepository, PostgresAppMembersRepository,
     PostgresAppRepository, PostgresAppSecretsRepo, PostgresAppUserInvitationRepo,
     PostgresAppUserPasswordResetRepo, PostgresAppUserRepository, PostgresAppUserRoleRepo,
@@ -214,6 +214,16 @@ pub async fn build_app(
         events.clone(),
         files_max_size,
     ));
+    // §11.6 shared group collections (files): group-keyed blobs under
+    // `<root>/files/groups/<group_id>/...`, resolved from cx.app_id's chain.
+    // Shares the per-file size cap; no events (no app to attribute a trigger to).
+    let group_files: Arc<dyn picloud_shared::GroupFilesService> =
+        Arc::new(GroupFilesServiceImpl::new(
+            Arc::new(FsGroupFilesRepo::new(pool.clone(), files_root.clone())),
+            Arc::new(PostgresGroupCollectionResolver::new(pool.clone())),
+            authz.clone(),
+            files_max_size,
+        ));
     // v1.1.6 realtime: the in-process broadcaster is shared between the
     // publish path (PubsubServiceImpl fans out to SSE subscribers after
     // the durable outbox fan-out) and the SSE endpoint (subscribe side).
@@ -360,7 +370,8 @@ pub async fn build_app(
         vars,
     )
     .with_group_kv(group_kv)
-    .with_group_docs(group_docs);
+    .with_group_docs(group_docs)
+    .with_group_files(group_files);
     // v1.1.9: keep the invoke depth bound aligned with the dispatcher's
     // trigger-depth bound (same counter under the hood).
     let engine_limits = Limits {