Add curated manifest-entry -> Application link (honest app tracking)

The honest replacement for the backed-out auto-seeding: instead of scraping
manifest labels into duplicate Application rows, an entry can be LINKED to an
existing catalog Application, cross-referencing what shopdb already tracks.

- Model: manifestentries.appid (nullable soft ref to core applications; in the
  0001 baseline). It is shopdb METADATA, deliberately NOT a manifest field - it
  never appears in the rendered manifest JSON, so enforcement + parity are
  unaffected (test asserts it stays out of the preview manifest).
- API: _entry_payload returns appid + resolved appname; create/update accept an
  optional appid (validated, unknown id ignored, null unlinks) via _apply_app_link;
  GET /geenforce/applications is the picker source (id + name).
- Editor: a "Tracked application (optional)" select in the entry modal, and the
  entry summary line notes the linked app ("...; tracked: eDNC").
- Foundation for a future desired-vs-observed compliance view.

889 tests green (incl. the link test + parity/migration unaffected); build +
naming green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

plugins/geenforce/migrations/versions/0001_geenforce_baseline.py

@@ -68,6 +68,7 @@ def upgrade():
         sa.Column('waittimeoutsec', sa.Integer(), nullable=True),
         sa.Column('applymode', sa.String(length=16), nullable=True),
         sa.Column('updatewindow', sa.String(length=11), nullable=True),
+        sa.Column('appid', sa.Integer(), nullable=True),
         sa.Column('preenrollment', sa.Boolean(), nullable=False),
         sa.Column('killafterdetection', sa.Boolean(), nullable=False),
         sa.Column('pctypesstrict', sa.Boolean(), nullable=False),