feat: cascade trigger script_path on runnable rename + fix trigger permissioned_as (#8823)

* feat: cascade trigger script_path updates on script/flow rename + fix trigger permissioned_as

Backend: When a script or flow path is renamed, automatically update script_path
across all trigger tables (http, email, kafka, websocket, postgres, mqtt, nats,
sqs, gcp, native). Long-running triggers get server_id reset to force restart.
Native triggers additionally get async webhook URL re-registration with external
services (Google, Nextcloud) via token rotation + handler.update().

Frontend: Fix permissioned_as handling across all trigger/schedule editors:
- Allow setting permissioned_as on trigger creation (not just edit) for admins
- Fix hasChanged detection for permissioned_as changes
- Fix FolderEditor group selector showing usernames instead of group names

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* refactor: rename script_rename -> runnable_rename for consistency

"Runnable" is the correct term for both scripts and flows.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* refactor: remove native trigger re-registration from runnable rename

Keep it simple — only update script_path in the DB for non-native triggers.
Native triggers require external service re-registration (token rotation +
webhook URL update) which adds significant complexity; defer to a future PR.

sqlx files for the updated CTE query need regenerating.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* sqlx

* refactor: call update_triggers_script_path directly, remove windmill-trigger wrapper

No need for the extra module/dep — the common function is called directly
from scripts.rs and flows.rs with inline error mapping.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: reject empty principal in folder default permissioned_as validation

`u/` and `g/` (no name after prefix) were passing validation. Use regex
to require at least one character after the prefix.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: prevent async folder-default load from overwriting user's permissioned_as choice

Split the initialization effect into two: one that resets on trigger switch
(tracks permissionedAs), and one that handles folder default loading (tracks
folderDefault.value). The second effect is guarded by a userHasSelected flag
set in handleSelect, so a late-arriving folder default doesn't wipe the
user's explicit selection.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* lock

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/windmill-api-scripts/src/scripts.rs

@@ -1151,6 +1151,18 @@ async fn create_script_internal<'c>(
         .execute(&mut *tx)
         .await?;
 
+        if p_path != &ns.path {
+            windmill_common::triggers::update_triggers_script_path(
+                &mut tx, &ns.path, p_path, &w_id, false,
+            )
+            .await
+            .map_err(|e| {
+                error::Error::internal_err(format!(
+                    "Error updating triggers due to runnable path change: {e:#}"
+                ))
+            })?;
+        }
+
         for schedule in schedulables {
             clear_schedule(&mut tx, &schedule.path, &w_id).await?;