feat(apps): stepped creation wizard, branch previews, and app-creation fixes

This session (frontend focus):
- Rebuild /apps/new as a 4-step wizard (Basics → Configure → Trigger → Review):
  WizardRail, SourceKindPicker card grid, AppManifest review, per-step validation,
  ConfirmDialog-based unsaved-changes guard.
- Extract lib/workload/sourceForms.ts (single source of truth for source_config)
  + {Image,Compose,Static,Dockerfile}SourceForm + StaticDiscoveryWizard; fold the
  /apps/[id] edit form onto the same components (removes the duplication). Add
  vitest + sourceForms unit tests.
- Branch preview environments UI: /chain is_preview/preview_branch + a Preview
  environments panel on /apps/[id] (per-branch URLs, ConfirmDialog teardown, armed
  state); RegistryImagePicker on the registry trigger and the image source.
- Fixes: image-inspect 404 -> admin-gated POST /api/discovery/image/inspect;
  conflict-panel blur flicker; friendly localized discovery errors; CPU/Memory
  label hints; dashboard + /apps "Total workloads" count only source_kind workloads
  (drop stale trigger_kind gate); NPM cert/access-list name cache; EntityPicker
  empty-list guard.
- Update CLAUDE.md frontend conventions + add a Build & Test section.

Also captures pre-existing in-progress platform work (not from this session):
workload notifications, Prometheus metrics export, store lockfile, health probes,
backup hardening, and related store/webhook/scheduler changes.

web/src/routes/apps/+page.svelte

@@ -11,12 +11,12 @@
 	let error = $state('');
 	let filter = $state<'all' | string>('all');
 
-	// Plugin-native rows are the ones with both source_kind and trigger_kind
-	// populated. Legacy project/stack/site rows still appear in
-	// /api/workloads — those are surfaced under their own sections.
-	const pluginRows = $derived(
-		workloads.filter((w) => w.source_kind !== '' && w.trigger_kind !== '')
-	);
+	// Plugin-native rows are those with a source_kind. trigger_kind is no
+	// longer on the workload row (triggers are first-class bindings now), so a
+	// manual/binding-trigger app legitimately has an empty trigger_kind and
+	// must NOT be filtered out. Legacy pre-cutover project/stack/site rows
+	// carry an empty source_kind and are excluded — they have no UI home.
+	const pluginRows = $derived(workloads.filter((w) => w.source_kind !== ''));
 	const filtered = $derived(
 		filter === 'all' ? pluginRows : pluginRows.filter((w) => w.source_kind === filter)
 	);