feat(apps): per-workload deploy history, rollback, and resource metrics

Two additions to the app detail page, each backed by a per-workload
endpoint.

Deploy history + rollback:
- New deploy_history table — a structured, version-pinned ledger of every
  dispatch (success AND failure), distinct from the free-text event_log.
  Recorded at the single DispatchPlugin choke point so every source kind
  is covered. The raw deploy error is never persisted (it can carry
  registry-auth / compose-stdout secrets) — only a generic marker, with
  detail going to slog. Pruned to the newest N per workload; cascade-
  deleted with the workload.
- GET /api/workloads/{id}/deploys lists the ledger; POST .../rollback
  (admin) replays a prior successful deploy's pinned reference as a
  rollback-reason dispatch. Phase 1 is image-source only (RollbackCapable);
  git-built sources need checkout-by-commit, a later phase.
- DeployHistoryPanel.svelte renders the ledger with confirm-gated rollback.

Per-workload metrics:
- ListContainerStatsSamplesByWorkload joins the existing container stats
  samples through the containers index; GET /api/workloads/{id}/stats/history
  aggregates CPU/memory per timestamp across the workload's containers.
- WorkloadMetricsPanel.svelte reuses ResourceChart (CPU% + memory MiB,
  windowed, 15s poll).

en/ru i18n added with parity. Tests: store CRUD + cascade + workload-scoped
join, deployer recording (incl. secret-non-leak on failure), API rollback
guards, and per-timestamp aggregation. Plans under docs/plans/.

web/src/routes/apps/[id]/+page.svelte

@@ -33,6 +33,8 @@
 	import ToggleSwitch from '$lib/components/ToggleSwitch.svelte';
 	import WorkloadNotificationsPanel from '$lib/components/WorkloadNotificationsPanel.svelte';
 	import WorkloadSnapshotsPanel from '$lib/components/WorkloadSnapshotsPanel.svelte';
+	import DeployHistoryPanel from '$lib/components/DeployHistoryPanel.svelte';
+	import WorkloadMetricsPanel from '$lib/components/WorkloadMetricsPanel.svelte';
 	import TriggerKindForm, {
 		createTriggerKindFormState,
 		isTriggerFormValid,
@@ -2808,6 +2810,16 @@
 			</section>
 		{/if}
 
+		<!-- ── Per-workload metrics (CPU/memory) ──────────── -->
+		{#if !editing}
+			<WorkloadMetricsPanel workloadId={id} />
+		{/if}
+
+		<!-- ── Deploy history + rollback ──────────────────── -->
+		{#if !editing}
+			<DeployHistoryPanel workloadId={id} />
+		{/if}
+
 		<!-- ── Per-workload notification routes ───────────── -->
 		{#if !editing}
 			<WorkloadNotificationsPanel workloadId={id} />