fix: grant dispatch_event table to windmill roles (#9852)

The dispatch_event table (migration 20260523055641) was created relying on
ALTER DEFAULT PRIVILEGES to reach windmill_user/windmill_admin. Those default
privileges only apply to objects created by the role that set them
(20250205131523), so deployments whose migration runner is a different role
leave dispatch_event ungranted. Direct writes then run as the invoking role and
fail with "permission denied for table dispatch_event" -- notably the DELETE in
delete_jobs (windmill-common/src/jobs.rs) that reaps a job's side rows on
schedule disable, and the dispatcher insert in asset_dispatch.rs.

Grant explicitly, same fix as notify_event (20260619091631) and script_trigger
(20260619112847). GRANT is idempotent so re-application (squash, or an operator
who already granted manually) is a no-op.

Fixes WIN-2112

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

backend/migrations/20260701080313_grant_dispatch_event_to_windmill_roles.down.sql

@@ -0,0 +1,4 @@
+REVOKE ALL ON dispatch_event FROM windmill_user;
+REVOKE ALL ON dispatch_event FROM windmill_admin;
+REVOKE ALL ON SEQUENCE dispatch_event_id_seq FROM windmill_user;
+REVOKE ALL ON SEQUENCE dispatch_event_id_seq FROM windmill_admin;

backend/migrations/20260701080313_grant_dispatch_event_to_windmill_roles.up.sql

@@ -0,0 +1,15 @@
+-- The dispatch_event table (migration 20260523055641_dispatch_event) was
+-- created relying on ALTER DEFAULT PRIVILEGES to grant access to windmill_user
+-- and windmill_admin. Those default privileges only apply to objects created by
+-- the role that set them (migration 20250205131523), so deployments whose
+-- migration runner is a different role leave dispatch_event ungranted. Direct
+-- writes run as the invoking role -- the dispatcher insert (asset_dispatch.rs)
+-- and the DELETE in delete_jobs (windmill-common/src/jobs.rs), reached whenever
+-- a job's side rows are reaped, e.g. on schedule disable -- and fail with
+-- "permission denied for table dispatch_event". Grant explicitly to guarantee
+-- access regardless of who ran the migrations (same fix as notify_event in
+-- 20260619091631 and script_trigger in 20260619112847).
+GRANT ALL ON dispatch_event TO windmill_user;
+GRANT ALL ON dispatch_event TO windmill_admin;
+GRANT ALL ON SEQUENCE dispatch_event_id_seq TO windmill_user;
+GRANT ALL ON SEQUENCE dispatch_event_id_seq TO windmill_admin;