Feat event bus subscriptions + trigger system (v0.2.2)

Three trigger primitives replacing the old monolithic scheduler:

- Event triggers: extensions subscribe to bus patterns via manifest,
  async handler invocation through sandbox.CallEntryPoint
- Webhook triggers: inbound HTTP at /api/v1/hooks/:pkg/:slug with
  HMAC-SHA256 verification and synchronous Starlark response
- Scheduled tasks: user-created cron scripts with restricted sandbox
  (no raw HTTP, no DB table creation), runs as creator identity

New tables: triggers, scheduled_tasks, trigger_logs (postgres + sqlite).
New permission: triggers.register. Full admin + user CRUD APIs.
SyncManifestTriggers hooked into seed and install flows.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/models/models_extension_perm.go

@@ -34,6 +34,7 @@ const (
 	ExtPermFormValidate         = "forms.validate"    // v0.29.3: form validation hooks
 	ExtPermWorkflowAccess       = "workflow.access"   // v0.30.2: workflow definition + stage data access
 	ExtPermConnectionsRead      = "connections.read"  // v0.38.1: extension connection resolution
+	ExtPermTriggersRegister     = "triggers.register" // v0.2.2: event/webhook trigger registration
 )
 
 // ValidExtensionPermissions is the set of recognized permission keys.
@@ -46,6 +47,7 @@ var ValidExtensionPermissions = map[string]bool{
 	ExtPermFormValidate:         true,
 	ExtPermWorkflowAccess:       true,
 	ExtPermConnectionsRead:      true,
+	ExtPermTriggersRegister:     true,
 }
 
 // ── Extension Permission Model ───────────────