Add curated manifest-entry -> Application link (honest app tracking)

The honest replacement for the backed-out auto-seeding: instead of scraping
manifest labels into duplicate Application rows, an entry can be LINKED to an
existing catalog Application, cross-referencing what shopdb already tracks.

- Model: manifestentries.appid (nullable soft ref to core applications; in the
  0001 baseline). It is shopdb METADATA, deliberately NOT a manifest field - it
  never appears in the rendered manifest JSON, so enforcement + parity are
  unaffected (test asserts it stays out of the preview manifest).
- API: _entry_payload returns appid + resolved appname; create/update accept an
  optional appid (validated, unknown id ignored, null unlinks) via _apply_app_link;
  GET /geenforce/applications is the picker source (id + name).
- Editor: a "Tracked application (optional)" select in the entry modal, and the
  entry summary line notes the linked app ("...; tracked: eDNC").
- Foundation for a future desired-vs-observed compliance view.

889 tests green (incl. the link test + parity/migration unaffected); build +
naming green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

plugins/geenforce/models/manifest.py

@@ -119,6 +119,11 @@ class ManifestEntry(BaseModel):
     applymode = db.Column(db.String(16), nullable=True)     # inert in engine today
     updatewindow = db.Column(db.String(11), nullable=True)  # 'HH:MM-HH:MM', inert
 
+    # Optional CURATED link to a core Applications catalog row (soft ref, no FK
+    # to keep the plugin decoupled). shopdb metadata only - NOT part of the
+    # manifest JSON the engine reads, so it never affects enforcement or parity.
+    appid = db.Column(db.Integer, nullable=True)
+
     # Preinstall-only flags.
     preenrollment = db.Column(db.Boolean, nullable=False, default=False)
     killafterdetection = db.Column(db.Boolean, nullable=False, default=False)