feat: run jobs on instance creation when run_on_create is enabled

Jobs with run_on_create=true in their config fire automatically
after a new instance is created. Runs fire-and-forget so they don't
delay the 201 response. Option exposed as a checkbox in each job's
detail panel.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/api.test.js

@@ -623,6 +623,25 @@ describe('POST /api/jobs/:id/run', () => {
     expect(res.status).toBe(500)
   })
 
+  it('run_on_create: triggers matching jobs when an instance is created', async () => {
+    createJob({ ...testJob, config: JSON.stringify({ api_key: 'k', tailnet: 't', run_on_create: true }) })
+    const id = (await request(app).get('/api/jobs')).body[0].id
+    vi.stubGlobal('fetch', vi.fn().mockResolvedValue({ ok: true, json: async () => ({ devices: [] }) }))
+    await request(app).post('/api/instances').send(base)
+    await new Promise(r => setImmediate(r))
+    const detail = await request(app).get(`/api/jobs/${id}`)
+    expect(detail.body.runs).toHaveLength(1)
+    expect(detail.body.runs[0].status).toBe('success')
+  })
+
+  it('run_on_create: does not trigger jobs without the flag', async () => {
+    createJob(testJob)
+    const id = (await request(app).get('/api/jobs')).body[0].id
+    await request(app).post('/api/instances').send(base)
+    await new Promise(r => setImmediate(r))
+    expect((await request(app).get(`/api/jobs/${id}`)).body.runs).toHaveLength(0)
+  })
+
   it('semaphore_sync: parses ansible inventory and updates instances', async () => {
     const semaphoreJob = {
       key: 'semaphore_sync', name: 'Semaphore Sync', description: 'test',