feat(workload): /api/workloads /api/containers /api/apps endpoints

Adds the read API surface that the global Containers view (and
the per-workload container panel on project/stack/site detail
pages) consume.

- GET /api/workloads (?kind=)              → workload list
- GET /api/workloads/{id}                  → single workload
- GET /api/workloads/{id}/containers       → workload's containers
- PATCH /api/workloads/{id}/app            → assign/clear app_id (admin)

- GET /api/containers (?workload_id=&kind=&state=&app_id=)
                                           → global index, decorated
                                             with workload + app name
                                             so the table renders
                                             without N+1 fetches
- GET /api/containers/{id}                 → single container row

- GET  /api/apps                           → list
- GET  /api/apps/{id}                      → single
- POST /api/apps                           → create   (admin)
- PUT  /api/apps/{id}                      → update   (admin)
- DELETE /api/apps/{id}                    → delete   (admin) — clears
                                             app_id on owning workloads
                                             but leaves them assigned-to-none

Mutations on projects/stacks/sites still go through the existing
kind-specific endpoints; the new surface is read-only at the
workload layer.

internal/api/router.go

@@ -374,6 +374,30 @@ func (s *Server) Router() chi.Router {
 			// Stale container endpoints (read).
 			r.Get("/containers/stale", s.listStaleContainers)
 
+			// Workload-shaped endpoints (the unifying layer over project /
+			// stack / site). Read-only; mutations still go through the
+			// kind-specific endpoints (POST /projects, PUT /stacks/{id}, …).
+			r.Get("/workloads", s.listWorkloads)
+			r.Route("/workloads/{id}", func(r chi.Router) {
+				r.Get("/", s.getWorkload)
+				r.Get("/containers", s.listWorkloadContainers)
+				r.With(auth.AdminOnly).Patch("/app", s.updateWorkloadAppID)
+			})
+
+			// Global container index, joined to workload + app names.
+			r.Get("/containers", s.listAllContainers)
+			r.Get("/containers/{id}", s.getContainer)
+
+			// App grouping (optional UI; admin-gated mutations).
+			r.Get("/apps", s.listApps)
+			r.Get("/apps/{id}", s.getApp)
+			r.Group(func(r chi.Router) {
+				r.Use(auth.AdminOnly)
+				r.Post("/apps", s.createApp)
+				r.Put("/apps/{id}", s.updateApp)
+				r.Delete("/apps/{id}", s.deleteApp)
+			})
+
 			// System resources (read-only).
 			r.Get("/system/stats", s.getSystemStats)
 			r.Get("/system/stats/history", s.getSystemStatsHistory)