feat(apps): stepped creation wizard, branch previews, and app-creation fixes

This session (frontend focus):
- Rebuild /apps/new as a 4-step wizard (Basics → Configure → Trigger → Review):
  WizardRail, SourceKindPicker card grid, AppManifest review, per-step validation,
  ConfirmDialog-based unsaved-changes guard.
- Extract lib/workload/sourceForms.ts (single source of truth for source_config)
  + {Image,Compose,Static,Dockerfile}SourceForm + StaticDiscoveryWizard; fold the
  /apps/[id] edit form onto the same components (removes the duplication). Add
  vitest + sourceForms unit tests.
- Branch preview environments UI: /chain is_preview/preview_branch + a Preview
  environments panel on /apps/[id] (per-branch URLs, ConfirmDialog teardown, armed
  state); RegistryImagePicker on the registry trigger and the image source.
- Fixes: image-inspect 404 -> admin-gated POST /api/discovery/image/inspect;
  conflict-panel blur flicker; friendly localized discovery errors; CPU/Memory
  label hints; dashboard + /apps "Total workloads" count only source_kind workloads
  (drop stale trigger_kind gate); NPM cert/access-list name cache; EntityPicker
  empty-list guard.
- Update CLAUDE.md frontend conventions + add a Build & Test section.

Also captures pre-existing in-progress platform work (not from this session):
workload notifications, Prometheus metrics export, store lockfile, health probes,
backup hardening, and related store/webhook/scheduler changes.

internal/workload/plugin/source/dockerfile/naming.go

@@ -0,0 +1,32 @@
+package dockerfile
+
+import (
+	"fmt"
+
+	"github.com/alexei/tinyforge/internal/workload/plugin"
+)
+
+// idShort is the first 8 chars of the workload ID. Same shape as the
+// static plugin — workload names are not UNIQUE in the schema, the ID
+// short suffix is what keeps two same-named workloads from clobbering
+// each other's container/image artifacts.
+func idShort(w plugin.Workload) string {
+	if len(w.ID) < 8 {
+		return w.ID
+	}
+	return w.ID[:8]
+}
+
+// containerNameFor is the deterministic container name. Prefix `tf-build-`
+// distinguishes a dockerfile-built container from `dw-site-` (static) and
+// per-stage image names at a glance in `docker ps`.
+func containerNameFor(w plugin.Workload) string {
+	return fmt.Sprintf("tf-build-%s-%s", w.Name, idShort(w))
+}
+
+// imageTagFor is the deterministic image tag the build step emits. Same
+// shape as the container name so `docker images` shows the linkage at a
+// glance.
+func imageTagFor(w plugin.Workload) string {
+	return fmt.Sprintf("tf-build-%s-%s:latest", w.Name, idShort(w))
+}