feat(triggers): first-class triggers + bindings with fan-out webhook

Promote triggers from embedded workload fields to standalone records
joined to workloads via workload_trigger_bindings. One trigger (webhook,
registry watcher, git push, manual) now fans out to many workloads with
per-binding config overrides (top-level JSON merge, binding wins).

Backend
- new triggers + workload_trigger_bindings tables with ON DELETE CASCADE
- boot-time backfill of embedded trigger config inside per-workload tx
- store.ErrUnique sentinel translates SQLite UNIQUE at store boundary
- /api/triggers CRUD + /api/triggers/{id}/{webhook,bindings}
- /api/bindings/{id} update/delete; /api/workloads/{id}/triggers list+bind
- bindTriggerToWorkload accepts trigger_id or inline {kind,name,config}
- inline-create uses CreateTriggerWithBindingTx (no orphan triggers)
- validateBindingConfig enforces 8 KiB cap + plugin Validate on merged
- ListTriggersWithBindingCount + ListBindings*WithNames remove N+1
- POST /api/webhook/triggers/{secret} resolves trigger then fans out
- bounded worker pool (4) per request; per-binding error isolation
- outcome accounting: deployed / skipped / no-match / errored
- legacy /api/webhook/workloads/{secret} route removed (clean break;
  backfill keeps secrets resolvable at the new /triggers/{secret} path)
- reconciler gate dropped from (Source && Trigger) to Source only
- MergeJSONConfig returns freshly allocated slices (no fan-out aliasing)
- WithEffectiveTrigger lets existing Trigger.Match contract stay unchanged

Frontend
- /triggers list, new wizard, [id] detail (bindings, webhook rotate)
- workload create wizard: NEW / PICK / SKIP trigger modes
- workload detail: bindings panel + Add-trigger modal (inline / pick)
- per-binding override editor with merged-preview + 8 KiB guard
- "OVERRIDES n FIELDS" row badge when binding_config is non-empty
- shared TriggerKindForm component (registry / git / manual + JSON)
- 3 raw <input type=checkbox> replaced with <ToggleSwitch>
- full EN + RU i18n: redeployTriggers.*, apps.detail.bindings.*,
  apps.new.triggers.*, nav.triggers; event-triggers nav disambiguated

Doc
- WORKLOAD_REFACTOR_TODO: trigger-split marked DONE; next focus is
  the static-source inline port + hard legacy cutover (Priority 1)

internal/store/models.go

@@ -510,6 +510,43 @@ type Container struct {
 	UpdatedAt string `json:"updated_at"`
 }
 
+// Trigger is a first-class redeploy signal source. Triggers were embedded
+// in workload rows (workload.trigger_kind / trigger_config) until the
+// trigger-split refactor; they are now standalone records bound to
+// workloads via WorkloadTriggerBinding so a single trigger (a webhook,
+// registry watcher, schedule, git push) can fan out to many workloads.
+//
+// Webhook secrets live here, not on the workload — the inbound webhook
+// URL identifies a trigger, which then resolves its bindings to decide
+// which workloads to fire.
+type Trigger struct {
+	ID                      string `json:"id"`
+	Kind                    string `json:"kind"`           // registry | git | manual | schedule | log_scan | ...
+	Name                    string `json:"name"`           // human-readable, unique
+	Config                  string `json:"config"`         // JSON-encoded, decoded by the matching plugin
+	WebhookSecret           string `json:"-"`              // URL-identifier secret; never serialized
+	WebhookSigningSecret    string `json:"-"`              // HMAC key; never serialized
+	WebhookRequireSignature bool   `json:"webhook_require_signature"`
+	CreatedAt               string `json:"created_at"`
+	UpdatedAt               string `json:"updated_at"`
+}
+
+// WorkloadTriggerBinding joins a Workload to a Trigger. BindingConfig is
+// the per-binding override applied on top of Trigger.Config (top-level
+// JSON merge: binding fields win). Empty BindingConfig means "use the
+// trigger's config verbatim". Enabled false skips the binding without
+// deleting it (useful for paused stages).
+type WorkloadTriggerBinding struct {
+	ID            string `json:"id"`
+	WorkloadID    string `json:"workload_id"`
+	TriggerID     string `json:"trigger_id"`
+	BindingConfig string `json:"binding_config"` // JSON-encoded; "{}" = none
+	Enabled       bool   `json:"enabled"`
+	SortOrder     int    `json:"sort_order"`
+	CreatedAt     string `json:"created_at"`
+	UpdatedAt     string `json:"updated_at"`
+}
+
 // App is an optional grouping of workloads (e.g., "my-saas" = web project + worker stack + redis stack).
 // Schema lives here from day one so future UI work is unblocked, but no UI is wired in v1.
 type App struct {