feat: Function triggers — schedule, inbound hook, domain events

Migration 00016: function_id on scheduled_jobs/inbound_hooks,
event_pattern on functions, 'event' in the run-trigger enum.

- Jobs deliver to a function instead of HTTP when function_id is set;
  the run's status_code mirrors the process exit code. Clearing the
  field returns the job to URL delivery.
- Inbound hooks gain mode "function" — received body becomes stdin
  payload, acked immediately, run recorded async.
- event_pattern (document.*, *, exact type) fires the function detached
  on matching publishEvent — never blocks realtime/webhook fan-out.
- One executeFunction path serves manual/schedule/hook/event; run rows
  record the trigger source.
- Backend image now ships bun 1.3.14 so Functions work under compose.

Dashboard: job target picker, hook function mode, event-pattern field.

Verified live: job run → success (status_code 0), hook POST → run,
document.created → event run with correct payload.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

ROADMAP.md

@@ -357,11 +357,14 @@ Reusable templates + an operational send log.
 
 Ordered loosely by leverage. None committed; each gets scoped when picked.
 
-- **Phase 9 — Functions** — ✅ first slice shipped: `core.functions` +
+- **Phase 9 — Functions** — ✅ shipped: `core.functions` +
   `core.function_runs`, bun/deno exec runner (stdin payload, env injection,
-  capped output, timeout), invoke API + dashboard page. Remaining
-  candidates: schedule/event/HTTP triggers riding jobs + inbound hooks,
-  and isolated runtimes (sidecar/Firecracker) for untrusted code.
+  capped output, timeout), invoke API + dashboard page. Triggers shipped:
+  scheduled jobs (`function_id` on a job), inbound hooks (`mode:
+  "function"`), and domain events (`event_pattern`, e.g. `document.*`).
+  Runs record trigger source (`manual`/`schedule`/`hook`/`event`).
+  Remaining candidate: isolated runtimes (sidecar/Firecracker) for
+  untrusted code — functions still execute with backend host privileges.
 - **Phase 10 — Storage backends** — ✅ S3-compatible object storage shipped:
   `BACKEND_STORAGE_DRIVER=s3` + `S3_*` env vars, stdlib SigV4, verified
   against a real S3 server. Presigned-URL uploads for large files remain a