feat: Functions — JS/TS execution with run log

core.functions + core.function_runs: project-scoped code executed by a
runtime binary on the backend host (bun or deno per function). Payload
arrives on stdin + PRIMORA_PAYLOAD env; stdout/stderr captured per run
(capped), with status/exit code/duration. Invoke returns 502 + the
recorded run on failure so errors stay observable.

Dashboard gains a Functions page: code editor, JSON payload invoke,
live result, run history. Runner config via FUNCTIONS_RUNTIME /
FUNCTIONS_TIMEOUT_SECONDS / FUNCTIONS_MAX_OUTPUT_BYTES.

Verified live: bun ran code, stdin payload delivered, error path returns
502 with captured stderr; timeout kills at deadline.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/backend/db/migrations/00015_functions.sql

@@ -0,0 +1,40 @@
+-- +goose Up
+CREATE TABLE core.functions (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  project_id UUID NOT NULL REFERENCES core.projects(id) ON DELETE CASCADE,
+  name TEXT NOT NULL,
+  code TEXT NOT NULL,
+  runtime TEXT NOT NULL DEFAULT 'bun' CHECK (runtime IN ('bun','deno')),
+  enabled BOOLEAN NOT NULL DEFAULT TRUE,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  UNIQUE (project_id, name)
+);
+
+CREATE TABLE core.function_runs (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  function_id UUID NOT NULL REFERENCES core.functions(id) ON DELETE CASCADE,
+  trigger TEXT NOT NULL CHECK (trigger IN ('manual','schedule','hook')),
+  status TEXT NOT NULL CHECK (status IN ('success','error','timeout')),
+  exit_code INT,
+  stdout TEXT NOT NULL DEFAULT '',
+  stderr TEXT NOT NULL DEFAULT '',
+  duration_ms INT NOT NULL DEFAULT 0,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+CREATE INDEX function_runs_function_idx ON core.function_runs(function_id, created_at DESC);
+
+ALTER TABLE core.scheduled_job_runs
+  DROP CONSTRAINT scheduled_job_runs_triggered_by_check;
+ALTER TABLE core.scheduled_job_runs
+  ADD CONSTRAINT scheduled_job_runs_triggered_by_check
+  CHECK (triggered_by IN ('schedule','manual','hook','function'));
+
+-- +goose Down
+ALTER TABLE core.scheduled_job_runs
+  DROP CONSTRAINT scheduled_job_runs_triggered_by_check;
+ALTER TABLE core.scheduled_job_runs
+  ADD CONSTRAINT scheduled_job_runs_triggered_by_check
+  CHECK (triggered_by IN ('schedule','manual','hook'));
+DROP TABLE IF EXISTS core.function_runs;
+DROP TABLE IF EXISTS core.functions;

apps/backend/db/queries/functions.sql

@@ -0,0 +1,37 @@
+-- name: CreateFunction :one
+INSERT INTO core.functions (project_id, name, code, runtime)
+VALUES ($1, $2, $3, $4)
+RETURNING *;
+
+-- name: GetFunction :one
+SELECT * FROM core.functions WHERE id = $1;
+
+-- name: GetFunctionByName :one
+SELECT * FROM core.functions WHERE project_id = $1 AND name = $2;
+
+-- name: ListFunctions :many
+SELECT * FROM core.functions
+WHERE project_id = $1
+ORDER BY name;
+
+-- name: UpdateFunction :one
+UPDATE core.functions
+SET code = COALESCE(sqlc.narg('code'), code),
+    enabled = COALESCE(sqlc.narg('enabled'), enabled),
+    updated_at = NOW()
+WHERE id = $1 AND project_id = $2
+RETURNING *;
+
+-- name: DeleteFunction :exec
+DELETE FROM core.functions WHERE id = $1 AND project_id = $2;
+
+-- name: InsertFunctionRun :one
+INSERT INTO core.function_runs (function_id, trigger, status, exit_code, stdout, stderr, duration_ms)
+VALUES ($1, $2, $3, $4, $5, $6, $7)
+RETURNING *;
+
+-- name: ListFunctionRuns :many
+SELECT * FROM core.function_runs
+WHERE function_id = $1
+ORDER BY created_at DESC
+LIMIT $2;