feat(triggers): first-class triggers + bindings with fan-out webhook

Promote triggers from embedded workload fields to standalone records
joined to workloads via workload_trigger_bindings. One trigger (webhook,
registry watcher, git push, manual) now fans out to many workloads with
per-binding config overrides (top-level JSON merge, binding wins).

Backend
- new triggers + workload_trigger_bindings tables with ON DELETE CASCADE
- boot-time backfill of embedded trigger config inside per-workload tx
- store.ErrUnique sentinel translates SQLite UNIQUE at store boundary
- /api/triggers CRUD + /api/triggers/{id}/{webhook,bindings}
- /api/bindings/{id} update/delete; /api/workloads/{id}/triggers list+bind
- bindTriggerToWorkload accepts trigger_id or inline {kind,name,config}
- inline-create uses CreateTriggerWithBindingTx (no orphan triggers)
- validateBindingConfig enforces 8 KiB cap + plugin Validate on merged
- ListTriggersWithBindingCount + ListBindings*WithNames remove N+1
- POST /api/webhook/triggers/{secret} resolves trigger then fans out
- bounded worker pool (4) per request; per-binding error isolation
- outcome accounting: deployed / skipped / no-match / errored
- legacy /api/webhook/workloads/{secret} route removed (clean break;
  backfill keeps secrets resolvable at the new /triggers/{secret} path)
- reconciler gate dropped from (Source && Trigger) to Source only
- MergeJSONConfig returns freshly allocated slices (no fan-out aliasing)
- WithEffectiveTrigger lets existing Trigger.Match contract stay unchanged

Frontend
- /triggers list, new wizard, [id] detail (bindings, webhook rotate)
- workload create wizard: NEW / PICK / SKIP trigger modes
- workload detail: bindings panel + Add-trigger modal (inline / pick)
- per-binding override editor with merged-preview + 8 KiB guard
- "OVERRIDES n FIELDS" row badge when binding_config is non-empty
- shared TriggerKindForm component (registry / git / manual + JSON)
- 3 raw <input type=checkbox> replaced with <ToggleSwitch>
- full EN + RU i18n: redeployTriggers.*, apps.detail.bindings.*,
  apps.new.triggers.*, nav.triggers; event-triggers nav disambiguated

Doc
- WORKLOAD_REFACTOR_TODO: trigger-split marked DONE; next focus is
  the static-source inline port + hard legacy cutover (Priority 1)

web/src/lib/api.ts

@@ -1186,6 +1186,128 @@ export function getHookKindSchema(kind: string, signal?: AbortSignal): Promise<H
 	return get<HookKindSchema>(`/api/hooks/kinds/${kind}/schema`, signal);
 }
 
+// ── Triggers (first-class redeploy signal sources) ──────────────────
+
+export interface RedeployTrigger {
+	id: string;
+	kind: string;
+	name: string;
+	config: unknown;
+	webhook_enabled: boolean;
+	webhook_require_signature: boolean;
+	binding_count: number;
+	created_at: string;
+	updated_at: string;
+}
+
+export interface TriggerWebhook {
+	url: string;
+	secret: string;
+	webhook_require_signature: boolean;
+}
+
+export interface TriggerBinding {
+	id: string;
+	workload_id: string;
+	workload_name: string;
+	trigger_id: string;
+	binding_config: unknown;
+	enabled: boolean;
+	sort_order: number;
+	created_at: string;
+	updated_at: string;
+}
+
+export interface WorkloadTriggerBinding extends TriggerBinding {
+	trigger_kind: string;
+	trigger_name: string;
+}
+
+export interface TriggerInput {
+	kind: string;
+	name: string;
+	config: unknown;
+	webhook_enabled: boolean;
+	webhook_require_signature: boolean;
+}
+
+export interface BindingInput {
+	workload_id: string;
+	binding_config?: unknown;
+	enabled?: boolean;
+	sort_order?: number;
+}
+
+export interface WorkloadBindInput {
+	trigger_id?: string;
+	binding_config?: unknown;
+	enabled?: boolean;
+	sort_order?: number;
+	inline?: TriggerInput;
+}
+
+export function listTriggers(kind?: string, signal?: AbortSignal): Promise<RedeployTrigger[]> {
+	const path = kind ? `/api/triggers?kind=${encodeURIComponent(kind)}` : '/api/triggers';
+	return get<RedeployTrigger[]>(path, signal);
+}
+
+export function getTrigger(id: string, signal?: AbortSignal): Promise<RedeployTrigger> {
+	return get<RedeployTrigger>(`/api/triggers/${id}`, signal);
+}
+
+export function createTrigger(body: TriggerInput): Promise<RedeployTrigger> {
+	return post<RedeployTrigger>('/api/triggers', body);
+}
+
+export function updateTrigger(id: string, body: TriggerInput): Promise<RedeployTrigger> {
+	return put<RedeployTrigger>(`/api/triggers/${id}`, body);
+}
+
+export function deleteTrigger(id: string): Promise<{ deleted: string }> {
+	return del<{ deleted: string }>(`/api/triggers/${id}`);
+}
+
+export function getTriggerWebhook(id: string, signal?: AbortSignal): Promise<TriggerWebhook> {
+	return get<TriggerWebhook>(`/api/triggers/${id}/webhook`, signal);
+}
+
+export function regenerateTriggerWebhook(id: string): Promise<{ secret: string; url: string }> {
+	return post<{ secret: string; url: string }>(`/api/triggers/${id}/webhook/regenerate`);
+}
+
+export function listBindingsForTrigger(id: string, signal?: AbortSignal): Promise<TriggerBinding[]> {
+	return get<TriggerBinding[]>(`/api/triggers/${id}/bindings`, signal);
+}
+
+export function bindWorkloadToTrigger(triggerId: string, body: BindingInput): Promise<TriggerBinding> {
+	return post<TriggerBinding>(`/api/triggers/${triggerId}/bindings`, body);
+}
+
+export function listBindingsForWorkload(
+	workloadId: string,
+	signal?: AbortSignal
+): Promise<WorkloadTriggerBinding[]> {
+	return get<WorkloadTriggerBinding[]>(`/api/workloads/${workloadId}/triggers`, signal);
+}
+
+export function bindTriggerToWorkload(
+	workloadId: string,
+	body: WorkloadBindInput
+): Promise<TriggerBinding> {
+	return post<TriggerBinding>(`/api/workloads/${workloadId}/triggers`, body);
+}
+
+export function updateBinding(
+	id: string,
+	body: { binding_config?: unknown; enabled?: boolean; sort_order?: number }
+): Promise<TriggerBinding> {
+	return put<TriggerBinding>(`/api/bindings/${id}`, body);
+}
+
+export function deleteBinding(id: string): Promise<{ deleted: string }> {
+	return del<{ deleted: string }>(`/api/bindings/${id}`);
+}
+
 export interface WorkloadChainNode {
 	id: string;
 	name: string;