docs(events): a trigger can start a run (Rust §14.3 stage 9, D370)

- EVENTS.md §E "Starting a run from a trigger": `starts`, the third
  emit subscriber, the four rules (verified, one at a time, cooldown,
  no event.*), the run's origin, and what is deliberately not in it.
  §D: event_runs.origin and a twelfth table, event_trigger_starts.
  API surface: triggerStarts on GET /admin/events/:id, origin on the
  run console.
- BACKEND_DESIGN.md: event_runs.origin and event_trigger_starts.
- PLAN_REDESIGNS §14.3.21: stage 9 as built, eight settled-in-code
  points, tests and the Module-uo proof; pointers in §9, §14.3.11 and
  §14.3.12. This ends the §14.3 build.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

website/BACKEND_DESIGN.md

@@ -1136,6 +1136,13 @@ pipeline has already announced without either job standing on the other's toes.
 means *"the post's job"* — the post admin panel, its retry button, `posts.announced_at` — still means
 the one with a NULL `run_id`.
 
+**Starting a run from a trigger** (2026-10, Rust PLAN_REDESIGNS §14.3.12) added `event_runs.origin`
+(below) and a seventh table, **`event_trigger_starts`**: one row per definition a trigger has tried to
+start — `definition_id` (PK, `ON DELETE CASCADE`), `claimed_at`, `last_started_at`, `last_run_id`, the
+counts `ignored_running` / `ignored_cooldown` / `ignored_unverified`, and `last_ignored_at` /
+`last_ignored_reason`. The claim that makes one-run-at-a-time and the cooldown hold is a conditional
+`UPDATE` of it; the counts are since the last trigger-started run and are what the editor shows.
+
 Core owns the engine; a module owns the meaning. No column below carries a game noun: an action id,
 a `scope`, a resource kind and a budget dimension are opaque strings core stores and never
 interprets.
@@ -1217,6 +1224,7 @@ makes a run reproducible and an audit answerable after the definition has moved
 | results_published_at | DATETIME NULL | when the run's results table was last ranked and published (phase 10). A stamp rather than a status: *"may I show this table"* and *"when was it settled"* are the same column. `core.results.publish` re-stamps rather than guarding on NULL, because a second publication after a late correction is a real one |
 | claimed_by / claim_expires_at | VARCHAR(64) NULL / DATETIME NULL | the lease. Written by the runner |
 | started_by | INT NULL FK→users(id) ON DELETE SET NULL | |
+| origin | JSON NULL | the game firing that started it, when a trigger did (2026-10, EVENTS.md §E *Starting a run from a trigger*): trigger id and label, when it fired, its subject, the matched condition and the trigger's declared variables. NULL for a run started by hand or by the schedule. A column and not only a log line because the run log is pruned |
 | last_error | VARCHAR(500) NULL | |
 | created_at / updated_at | DATETIME | |