feat(v1.1.4): outbound HTTP SDK + cron triggers

HTTP (`http::*`):
- `HttpService` trait (picloud-shared) + reqwest-backed `HttpServiceImpl`
  (manager-core), wired into the `Services` bundle.
- SSRF deny-list applied to the resolved IP via a custom reqwest
  `dns_resolver` (covers every redirect hop + defeats DNS rebinding) plus
  a literal-IP check at URL-parse time. Scheme/port restrictions, request
  + response body caps (stream-with-cap), layered timeout. Error reason is
  a CIDR category, never the IP. `PICLOUD_HTTP_ALLOW_PRIVATE` dev override
  (logs a startup warning).
- Rhai bridge with three-arg split `verb(url, body, opts)` (resolves the
  brief's body-vs-opts contradiction; unknown opt keys throw). Body
  dispatch by type; response `#{status,headers,body,body_raw}` with JSON
  auto-parse; non-2xx does not throw.
- `Capability::AppHttpRequest` → existing `script:write` scope (no new
  Scope variant). `SdkCallCx` gains `script_id` (attribution + User-Agent).

Cron triggers (4th trigger kind):
- Migration 0017 widens the kind/source_kind CHECKs and adds
  `cron_trigger_details`. `cron`/`chrono-tz` parse + validate 6-field
  schedules and IANA timezones.
- `spawn_cron_scheduler` polls due triggers and enqueues to the universal
  outbox; the dispatcher delivers them (one-line match-arm extension).
  Catch-up fires exactly once per trigger per tick, not once per missed
  window. `ctx.event.cron` for handlers.
- `POST /api/v1/admin/apps/{id}/triggers/cron` reuses the v1.1.3
  cross-app + kind!=module target check.
- Dashboard: admin-gated Triggers tab (cron create form + list).

Follow-ups: redact module backend errors at the resolver boundary (log
original at error level); pin `rhai = "=1.24"`; CHANGELOG incl. retroactive
v1.1.3 cross-app-trigger security note. Version bumps: workspace 1.1.4,
SDK 1.5, dashboard 0.10.0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

dashboard/src/lib/api.ts

@@ -211,6 +211,42 @@ export interface DeadLetterRow {
 	resolution: 'replayed' | 'ignored' | 'handled_by_script' | 'handler_failed' | null;
 }
 
+export type TriggerKind = 'kv' | 'docs' | 'dead_letter' | 'cron';
+export type TriggerDispatchMode = 'sync' | 'async';
+
+/// Per-kind detail, tagged by `kind` to match the Rust serde shape.
+export type TriggerDetails =
+	| { kind: 'kv'; collection_glob: string; ops: string[] }
+	| { kind: 'docs'; collection_glob: string; ops: string[] }
+	| { kind: 'dead_letter'; source_filter?: string; trigger_id_filter?: string; script_id_filter?: string }
+	| { kind: 'cron'; schedule: string; timezone: string; last_fired_at?: string | null };
+
+export interface Trigger {
+	id: string;
+	app_id: string;
+	script_id: string;
+	kind: TriggerKind;
+	enabled: boolean;
+	dispatch_mode: TriggerDispatchMode;
+	retry_max_attempts: number;
+	retry_backoff: 'exponential' | 'linear' | 'constant';
+	retry_base_ms: number;
+	registered_by_principal: string;
+	created_at: string;
+	updated_at: string;
+	details: TriggerDetails;
+}
+
+export interface CreateCronTriggerInput {
+	script_id: string;
+	schedule: string;
+	timezone: string;
+	dispatch_mode?: TriggerDispatchMode;
+	retry_max_attempts?: number;
+	retry_backoff?: 'exponential' | 'linear' | 'constant';
+	retry_base_ms?: number;
+}
+
 export interface ExecutionResult {
 	status: number;
 	headers: Record<string, string>;
@@ -572,6 +608,23 @@ export const api = {
 			)
 	},
 
+	triggers: {
+		list: (idOrSlug: string) =>
+			adminRequest<{ triggers: Trigger[] }>(
+				`/api/v1/admin/apps/${encodeURIComponent(idOrSlug)}/triggers`
+			),
+		createCron: (idOrSlug: string, input: CreateCronTriggerInput) =>
+			adminRequest<Trigger>(
+				`/api/v1/admin/apps/${encodeURIComponent(idOrSlug)}/triggers/cron`,
+				{ method: 'POST', body: JSON.stringify(input) }
+			),
+		remove: (idOrSlug: string, triggerId: string) =>
+			adminRequest<null>(
+				`/api/v1/admin/apps/${encodeURIComponent(idOrSlug)}/triggers/${triggerId}`,
+				{ method: 'DELETE' }
+			)
+	},
+
 	execute: async (
 		id: string,
 		body: unknown,