feat(triggers): add Kilo-admin Dedicated Standard controls

[pandemicsyn]

Summary

PR 3 of the Dedicated Standard rollout, stacked on #5624. This is a new PR for the web UI and authorization layer; #5624 remains unchanged.

• Add Automatic / Dedicated Standard selection to Cloud Agent trigger create and edit flows for both webhook and scheduled activation modes.
• Replace the planned PostHog rollout flag with authenticated Kilo-admin authorization (ctx.user.is_admin). A server capability query drives the UI, and create/update mutations independently reject explicit opt-ins from non-admins before writes. Organization roles do not grant this capability.
• Preserve existing allocations during unrelated edits; authorized non-admins can clear them back to Automatic. Keep saved allocations visible after admin access is removed and let a revoked in-progress selection recover to Automatic.
• Extend the internal worker client contract without changing worker execution, KiloClaw behavior, billing, or database schemas.

Verification

• Used the real local Next.js application, PostgreSQL, and webhook Worker with a disposable Kilo-admin account, environment profile, and authorized public repository.
• Created both webhook and scheduled triggers through the browser with Dedicated Standard selected; edit hydration and authoritative Worker reads retained isolated-standard.
• Removed admin access from the disposable account. The capability query returned false, and forged create/update opt-ins returned HTTP 403 with the Kilo-admin authorization message.
• Saved an unrelated edit as a non-admin; the browser omitted the unchanged allocation and the saved Dedicated Standard allocation survived.
• Cleared both trigger modes as a non-admin; browser requests sent explicit null, Worker reads returned Automatic, and the selector disappeared after clearing. New non-admin forms did not expose the selector.
• Checked the allocation control at 375px, 900px, and 1440px viewport widths and its associated help text. Captured the screenshot below from the logged-in admin page at /cloud/triggers/new.
• Deleted the temporary triggers, profile, integration, and user; restored the original core dev stack. No sessions were executed during this PR 3 UI smoke.

Visual Changes

Reviewer Notes

• Stacked base: feat/trigger-isolated-standard-allocation (feat(triggers): persist isolated Standard allocation #5624), not main, so this PR contains only the web exposure changes. Retarget after PR 2 is merged as appropriate.
• Deployment order: Cloud Agent support from feat(cloud-agent-next): add isolated Standard allocation #5520 and worker persistence/forwarding from feat(triggers): persist isolated Standard allocation #5624 must be deployed before this web change is used. There is no PostHog dependency or worker-side flag evaluation.
• This is a configuration-time admin gate, not an execution kill switch. Removing admin access does not stop an existing configured trigger. Omitted update preserves; null clears; an explicit isolated-standard opt-in requires Kilo-admin status.
• Existing ownership, organization access, and profile authorization remain in place. Stored target type controls KiloClaw update rejection.
• Automated checks passed: 60 tests across the router, worker client, and form suites; pnpm --filter web typecheck; pnpm --filter web lint; targeted formatting; git diff --check.
• The UI uses the existing Cloud design overlay, interaction guidance, semantic tokens, and Radix Select primitive. The screenshot is a small checked-in PR asset, pinned to this commit for stable rendering.
• Production resource limits, real billing, and containment-enabled execution were not revalidated here. The preceding worker execution smoke and its unresolved first-attempt wrapper_no_output caveat are recorded on feat(triggers): persist isolated Standard allocation #5624.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (9 files)

• apps/web/src/app/(app)/cloud/webhooks/[triggerId]/EditWebhookTriggerContent.tsx
• apps/web/src/app/(app)/cloud/webhooks/new/CreateWebhookTriggerContent.tsx
• apps/web/src/components/webhook-triggers/TriggerForm.test.ts
• apps/web/src/components/webhook-triggers/TriggerForm.tsx
• apps/web/src/lib/webhook-agent/webhook-agent-client.test.ts
• apps/web/src/lib/webhook-agent/webhook-agent-client.ts
• apps/web/src/routers/webhook-triggers-router.schema.test.ts
• apps/web/src/routers/webhook-triggers-router.ts
• docs/pr-assets/trigger-dedicated-standard.png

---

_{Reviewed by grok-4.6 · Input: 121.7K · Output: 16.1K · Cached: 629K}

_{Review guidance: REVIEW.md from base branch feat/trigger-isolated-standard-allocation}