feat(triggers): first-class triggers + bindings with fan-out webhook

Promote triggers from embedded workload fields to standalone records
joined to workloads via workload_trigger_bindings. One trigger (webhook,
registry watcher, git push, manual) now fans out to many workloads with
per-binding config overrides (top-level JSON merge, binding wins).

Backend
- new triggers + workload_trigger_bindings tables with ON DELETE CASCADE
- boot-time backfill of embedded trigger config inside per-workload tx
- store.ErrUnique sentinel translates SQLite UNIQUE at store boundary
- /api/triggers CRUD + /api/triggers/{id}/{webhook,bindings}
- /api/bindings/{id} update/delete; /api/workloads/{id}/triggers list+bind
- bindTriggerToWorkload accepts trigger_id or inline {kind,name,config}
- inline-create uses CreateTriggerWithBindingTx (no orphan triggers)
- validateBindingConfig enforces 8 KiB cap + plugin Validate on merged
- ListTriggersWithBindingCount + ListBindings*WithNames remove N+1
- POST /api/webhook/triggers/{secret} resolves trigger then fans out
- bounded worker pool (4) per request; per-binding error isolation
- outcome accounting: deployed / skipped / no-match / errored
- legacy /api/webhook/workloads/{secret} route removed (clean break;
  backfill keeps secrets resolvable at the new /triggers/{secret} path)
- reconciler gate dropped from (Source && Trigger) to Source only
- MergeJSONConfig returns freshly allocated slices (no fan-out aliasing)
- WithEffectiveTrigger lets existing Trigger.Match contract stay unchanged

Frontend
- /triggers list, new wizard, [id] detail (bindings, webhook rotate)
- workload create wizard: NEW / PICK / SKIP trigger modes
- workload detail: bindings panel + Add-trigger modal (inline / pick)
- per-binding override editor with merged-preview + 8 KiB guard
- "OVERRIDES n FIELDS" row badge when binding_config is non-empty
- shared TriggerKindForm component (registry / git / manual + JSON)
- 3 raw <input type=checkbox> replaced with <ToggleSwitch>
- full EN + RU i18n: redeployTriggers.*, apps.detail.bindings.*,
  apps.new.triggers.*, nav.triggers; event-triggers nav disambiguated

Doc
- WORKLOAD_REFACTOR_TODO: trigger-split marked DONE; next focus is
  the static-source inline port + hard legacy cutover (Priority 1)

internal/api/router.go

@@ -430,6 +430,12 @@ func (s *Server) Router() chi.Router {
 				// running image tag onto this workload's default_tag.
 				r.Get("/chain", s.getWorkloadChain)
 				r.With(auth.AdminOnly).Post("/promote-from/{sourceID}", s.promoteFromWorkload)
+
+				// Trigger bindings on this workload — the symmetric view
+				// of /triggers/{id}/bindings keyed on the workload side
+				// so the workload detail page is one round-trip.
+				r.Get("/triggers", s.listBindingsForWorkload)
+				r.With(auth.AdminOnly).Post("/triggers", s.bindTriggerToWorkload)
 			})
 
 			// Global container index, joined to workload + app names.
@@ -446,6 +452,26 @@ func (s *Server) Router() chi.Router {
 				r.Delete("/apps/{id}", s.deleteApp)
 			})
 
+			// First-class Triggers (redeploy signal sources). One trigger
+			// (registry / git / webhook / manual / schedule / log_scan)
+			// fans out to many workloads via workload_trigger_bindings.
+			// Reads are open to authenticated users; mutations + secret
+			// rotation are admin-gated.
+			r.Get("/triggers", s.listTriggers)
+			r.Get("/triggers/{id}", s.getTrigger)
+			r.Get("/triggers/{id}/bindings", s.listBindingsForTrigger)
+			r.Group(func(r chi.Router) {
+				r.Use(auth.AdminOnly)
+				r.Post("/triggers", s.createTrigger)
+				r.Put("/triggers/{id}", s.updateTrigger)
+				r.Delete("/triggers/{id}", s.deleteTrigger)
+				r.Get("/triggers/{id}/webhook", s.getTriggerWebhook)
+				r.Post("/triggers/{id}/webhook/regenerate", s.regenerateTriggerWebhook)
+				r.Post("/triggers/{id}/bindings", s.bindWorkloadToTrigger)
+				r.Put("/bindings/{bid}", s.updateBinding)
+				r.Delete("/bindings/{bid}", s.deleteBinding)
+			})
+
 			// Event triggers: filter+action rules over the event_log
 			// stream. Read endpoints are available to any authenticated
 			// user; mutations + test-dispatch are admin-gated since they