Feat event bus subscriptions + trigger system (v0.2.2)

Three trigger primitives replacing the old monolithic scheduler:

- Event triggers: extensions subscribe to bus patterns via manifest,
  async handler invocation through sandbox.CallEntryPoint
- Webhook triggers: inbound HTTP at /api/v1/hooks/:pkg/:slug with
  HMAC-SHA256 verification and synchronous Starlark response
- Scheduled tasks: user-created cron scripts with restricted sandbox
  (no raw HTTP, no DB table creation), runs as creator identity

New tables: triggers, scheduled_tasks, trigger_logs (postgres + sqlite).
New permission: triggers.register. Full admin + user CRUD APIs.
SyncManifestTriggers hooked into seed and install flows.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/main.go

@@ -29,6 +29,7 @@ import (
 	"switchboard-core/pages"
 	"switchboard-core/storage"
 	"switchboard-core/store"
+	"switchboard-core/triggers"
 	postgres "switchboard-core/store/postgres"
 	sqliteStore "switchboard-core/store/sqlite"
 )
@@ -174,6 +175,13 @@ func main() {
 		log.Printf("  ⚠️  Extension SSRF protection relaxed: private IPs allowed")
 	}
 
+	// ── Trigger Engine (v0.2.2) ─────────────────
+	triggerEngine := triggers.New(stores, starlarkRunner, bus)
+	if err := triggerEngine.Start(context.Background()); err != nil {
+		log.Printf("  ⚠️  Trigger engine start: %v", err)
+	}
+	triggers.SetGlobalEngine(triggerEngine)
+	defer triggerEngine.Stop()
 
 	r := gin.New()
 	r.Use(middleware.RequestID())
@@ -347,6 +355,11 @@ func main() {
 		extH := handlers.NewExtensionHandler(stores)
 		api.GET("/extensions/:id/assets/*path", extH.ServeExtensionAsset)
 
+		// ── Webhook Inbound (v0.2.2) ──────────────
+		// Public routes — HMAC-verified in handler, no auth middleware.
+		api.POST("/hooks/:package_id/:slug", triggerEngine.HandleWebhook)
+		api.GET("/hooks/:package_id/:slug", triggerEngine.HandleWebhook)
+
 		// ── Protected routes ────────────────────
 		protected := api.Group("")
 		protected.Use(middleware.Auth(cfg, stores.Users, userCache))
@@ -445,6 +458,16 @@ func main() {
 			protected.PUT("/notifications/preferences/:type", notifH.SetPreference)
 			protected.DELETE("/notifications/preferences/:type", notifH.DeletePreference)
 
+			// ── Scheduled Tasks — User (v0.2.2) ────
+			userSchedH := handlers.NewScheduleHandler(stores, triggerEngine)
+			protected.GET("/schedules", userSchedH.ListMySchedules)
+			protected.POST("/schedules", userSchedH.CreateSchedule)
+			protected.GET("/schedules/:id", userSchedH.GetSchedule)
+			protected.PUT("/schedules/:id", userSchedH.UpdateSchedule)
+			protected.DELETE("/schedules/:id", userSchedH.DeleteSchedule)
+			protected.POST("/schedules/:id/run", userSchedH.RunSchedule)
+			protected.GET("/schedules/:id/logs", userSchedH.ListScheduleLogs)
+
 			// Teams (user: my teams)
 			teams := handlers.NewTeamHandler(stores, keyResolver)
 			protected.GET("/teams/mine", teams.MyTeams)
@@ -649,6 +672,23 @@ func main() {
 			wfPkgH := handlers.NewWorkflowPackageHandler(stores)
 			admin.GET("/workflows/:id/export", wfPkgH.ExportWorkflowPackage)
 
+			// ── Triggers (v0.2.2) ─────────────────
+			trigH := handlers.NewTriggerHandler(stores, triggerEngine)
+			admin.GET("/triggers", trigH.ListTriggers)
+			admin.GET("/triggers/:id", trigH.GetTrigger)
+			admin.PUT("/triggers/:id/enable", trigH.EnableTrigger)
+			admin.PUT("/triggers/:id/disable", trigH.DisableTrigger)
+			admin.DELETE("/triggers/:id", trigH.DeleteTrigger)
+			admin.GET("/triggers/:id/logs", trigH.ListTriggerLogs)
+			admin.GET("/packages/:id/triggers", trigH.ListPackageTriggers)
+
+			// ── Scheduled Tasks — Admin (v0.2.2) ──
+			schedH := handlers.NewScheduleHandler(stores, triggerEngine)
+			admin.GET("/schedules", schedH.AdminListSchedules)
+			admin.PUT("/schedules/:id/enable", schedH.AdminEnableSchedule)
+			admin.PUT("/schedules/:id/disable", schedH.AdminDisableSchedule)
+			admin.DELETE("/schedules/:id", schedH.AdminDeleteSchedule)
+
 			// Surface aliases (backward compat — same handlers)
 			admin.GET("/surfaces", pkgAdm.ListPackages)
 			admin.GET("/surfaces/:id", pkgAdm.GetPackage)