feat(apps): stepped creation wizard, branch previews, and app-creation fixes

This session (frontend focus):
- Rebuild /apps/new as a 4-step wizard (Basics → Configure → Trigger → Review):
  WizardRail, SourceKindPicker card grid, AppManifest review, per-step validation,
  ConfirmDialog-based unsaved-changes guard.
- Extract lib/workload/sourceForms.ts (single source of truth for source_config)
  + {Image,Compose,Static,Dockerfile}SourceForm + StaticDiscoveryWizard; fold the
  /apps/[id] edit form onto the same components (removes the duplication). Add
  vitest + sourceForms unit tests.
- Branch preview environments UI: /chain is_preview/preview_branch + a Preview
  environments panel on /apps/[id] (per-branch URLs, ConfirmDialog teardown, armed
  state); RegistryImagePicker on the registry trigger and the image source.
- Fixes: image-inspect 404 -> admin-gated POST /api/discovery/image/inspect;
  conflict-panel blur flicker; friendly localized discovery errors; CPU/Memory
  label hints; dashboard + /apps "Total workloads" count only source_kind workloads
  (drop stale trigger_kind gate); NPM cert/access-list name cache; EntityPicker
  empty-list guard.
- Update CLAUDE.md frontend conventions + add a Build & Test section.

Also captures pre-existing in-progress platform work (not from this session):
workload notifications, Prometheus metrics export, store lockfile, health probes,
backup hardening, and related store/webhook/scheduler changes.

internal/workload/plugin/notify.go

@@ -0,0 +1,81 @@
+package plugin
+
+import (
+	"log/slog"
+
+	"github.com/alexei/tinyforge/internal/crypto"
+	"github.com/alexei/tinyforge/internal/notify"
+)
+
+// DispatchNotificationForWorkload sends `event` to every notification
+// route configured for the workload. Resolution order:
+//
+//  1. workload_notifications rows matching `event.Type` — multi-route
+//     fan-out (e.g. Slack alerts + Discord successes per workload).
+//  2. If zero matching rows AND the legacy single-URL columns on the
+//     workload row are set, send to that URL — backwards compat for
+//     installs that pre-date the new table.
+//  3. Otherwise, fall through to settings.notification_url so the global
+//     destination still fires for workloads with no per-row config.
+//
+// Secrets are decrypted via deps.EncKey before sending. A failed decrypt
+// degrades to "send unsigned" with a warning rather than dropping the
+// notification — the operator still gets the alert, they just need to
+// re-save the secret. Fire-and-forget: failures are logged inside
+// deps.Notifier and never bubble up here.
+//
+// Callers (static / dockerfile / image / compose plugins) pass an
+// already-populated Event; this helper does not synthesize the payload
+// shape, only the routing.
+func DispatchNotificationForWorkload(deps Deps, w Workload, event notify.Event) {
+	if deps.Notifier == nil {
+		return
+	}
+	rows, err := deps.Store.ListWorkloadNotifications(w.ID)
+	if err != nil {
+		slog.Warn("notify: list workload routes failed",
+			"workload", w.ID, "error", err)
+		rows = nil
+	}
+
+	matched := 0
+	for _, n := range rows {
+		if !n.MatchesEventType(event.Type) {
+			continue
+		}
+		matched++
+		secret := ""
+		if n.Secret != "" {
+			dec, derr := crypto.Decrypt(deps.EncKey, n.Secret)
+			if derr != nil {
+				slog.Warn("notify: decrypt workload secret failed — sending unsigned",
+					"workload", w.ID, "route", n.Name, "error", derr)
+			} else {
+				secret = dec
+			}
+		}
+		deps.Notifier.SendSigned(n.URL, secret, notify.TierSite, event)
+	}
+	if matched > 0 {
+		return
+	}
+
+	// Legacy fallback: single per-workload destination on workloads.notification_url.
+	if w.NotificationURL != "" {
+		deps.Notifier.SendSigned(w.NotificationURL, w.NotificationSecret, notify.TierSite, event)
+		return
+	}
+
+	// Global fallback so a one-line config in settings still notifies
+	// every workload without a per-row override.
+	settings, err := deps.Store.GetSettings()
+	if err != nil {
+		slog.Warn("notify: settings lookup for global fallback failed",
+			"workload", w.ID, "error", err)
+		return
+	}
+	if settings.NotificationURL == "" {
+		return
+	}
+	deps.Notifier.SendSigned(settings.NotificationURL, settings.NotificationSecret, notify.TierSettings, event)
+}