feat(cutover): hard legacy cutover — drop projects/stacks/sites/deploys

The clean-break delete that closes the workload-first refactor arc.
Net diff: ~30 backend files deleted, ~20 modified, ~12k LOC removed
on the Go side; entire /projects /stacks /sites /deploy frontend
trees gone; ~6.7k LOC removed on the Svelte/TypeScript side.

Backend
- API handlers gone: internal/api/{projects,stages,stage_env,stacks,
  static_sites,deploys,instances,volume_browser}.go
- Store CRUD + tests gone: internal/store/{projects,stages,stage_env,
  stacks,static_sites,static_site_secrets,deploys,poll_state,volumes,
  workload_sync}.go (+ _test.go siblings)
- Legacy deployer pipeline gone: internal/deployer/{bluegreen,promote,
  rollback,subdomain,resolver_test}.go; deployer.go trimmed to just the
  dispatch surface used by the plugin pipeline
- internal/staticsite/{manager,healthcheck}.go and
  internal/stack/manager.go gone (the rest of those packages stay as
  helpers imported by the static + compose plugins)
- internal/registry/poller.go gone (legacy registry poller)
- internal/volume.ResolvePath gone; ResolveWorkloadPath stays
- internal/webhook: handleWebhook (project) + handleSiteWebhook (site)
  gone; only POST /api/webhook/triggers/{secret} remains
- workload-side webhook URL handlers (getWorkloadWebhook +
  regenerateWorkloadWebhook + EnsureWorkloadWebhookSecret +
  SetWorkloadWebhookSecret + GetWorkloadByWebhookSecret) gone — they
  minted URLs that would 404 against the new trigger-only ingress
- cmd/server/main.go: dropped staticsite.Manager, stack.Manager,
  staticsite.HealthChecker, registry poller, SetSiteSyncTriggerer,
  SetStaticSiteManager, SetStackManager, wireStaticBackend
- store/store.go: idempotent DROP TABLE IF EXISTS for every legacy
  table (projects, stages, stage_env, volumes, deploys, deploy_logs,
  poll_states, stacks, stack_revisions, stack_deploys, static_sites,
  static_site_secrets); FK order children-then-parents
- store/models.go: dropped Project, Stage, Deploy, DeployLog, StageEnv,
  Volume, StaticSite, StaticSiteSecret, Stack, StackRevision,
  StackDeploy types; kept WorkloadKind constants as documented strings
- internal/store/helpers.go (new): BoolToInt, rowScanner,
  GenerateWebhookSecret extracted from deleted CRUD files
- internal/api/secrets.go (new): forwards to store.GenerateWebhookSecret
  so api + store paths share one secret-generation impl (no
  panic-vs-UUID-fallback divergence)
- internal/reconciler/reconciler.go: dropped legacy stack-by-compose
  + static-site label paths; only canonical tinyforge.workload.id
  dispatch remains
- providers (gitea_content/github_provider/gitlab_provider) gained
  path-traversal rejection on every tree entry
- internal/webhook ParsedImage / ParseImageRef demoted to package-
  private (no external callers)

Frontend
- /projects /stacks /sites /deploy routes deleted (entire trees)
- ProjectCard / InstanceCard / StaleContainerCard components deleted
- api.ts: dropped every project/stage/stack/site/deploy/instance
  helper + types (Project, Stage, Stack, StaticSite, Deploy,
  Instance, Volume, etc.); kept Workload, Container, App, Settings,
  Registry, EventTrigger, LogScanRule, webhook envelopes
- WorkloadWebhook type + getWorkloadWebhook/regenerateWorkloadWebhook
  api functions gone (mirror of the backend deletion above)
- web/src/routes/+layout.svelte: dropped /projects /sites /stacks
  /deploy nav entries, trimmed quick-nav keymap
- web/src/routes/+page.svelte: dashboard rewrite — reads
  listWorkloads + listContainers only; 4-card stat grid
  (workloads/running/failed/stale) + recent workloads strip
- navCounts.ts, SystemHealthCard.svelte, ContainerLogs.svelte,
  ContainerStats.svelte, StatusBadge.svelte, TagCombobox.svelte,
  proxies/+page.svelte, containers/+page.svelte all rewired to the
  workload-first surface
- AbortController plumbing on dashboard, nav-counts, stale page,
  SystemHealthCard so navigation doesn't leave dangling fetches
- i18n: dropped projects.*, projectDetail.*, envEditor.*,
  volumeEditor.*, volumeBrowser.*, quickDeploy.*, sites.*, stacks.*,
  instance.*, confirm.* namespaces; en/ru parity preserved (1042
  keys each)

Hardening from go-reviewer + security-reviewer + typescript-reviewer
subagent passes (0 CRITICAL across all three; 1 HIGH + ~12 MEDIUM
addressed inline before commit):

- Sec H1: dead-end workload webhook URL handlers (would mint URLs
  that 404 the new trigger-only ingress) deleted across backend +
  frontend
- Go M1: IsTerminalDeployStatus dropped (no production callers)
- Go M2: ParsedImage/ParseImageRef lowercased (in-package only)
- Go M6: generateWebhookSecret unified — api shim forwards to
  store.GenerateWebhookSecret
- Doc/comment freshness: stage_id (no longer FK), ProxyRoute legacy
  field names, workloadIDRow rationale, webhook_deliveries.target_type
  enum, WebhookDeliveryLog component header

Doc
- WORKLOAD_REFACTOR_TODO: cutover marked DONE; all three Priority 1
  items are now shipped. Next focus is Priority 3 polish (apps.* i18n
  + codemap entries) and Priority 4 tests.

Behavioral notes for operators upgrading from a pre-cutover build
- Existing rows in the dropped tables disappear on first boot.
- Legacy webhook URLs at /api/webhook/{secret} and
  /api/webhook/sites/{secret} return 404; CI configs must repoint to
  /api/webhook/triggers/{secret} (the trigger-split boot backfill
  lifted any embedded workload secret onto a Trigger row, so the
  secret value itself carries over).
- Frontend routes /projects /stacks /sites /deploy are gone; nav
  links replaced with /apps and /triggers.

internal/api/stats_history.go

@@ -1,28 +1,23 @@
 package api
 
 import (
-	"errors"
 	"log/slog"
 	"net/http"
 	"sort"
 	"strconv"
 	"time"
 
-	"github.com/go-chi/chi/v5"
-
 	"github.com/alexei/tinyforge/internal/auth"
-	"github.com/alexei/tinyforge/internal/stats"
 	"github.com/alexei/tinyforge/internal/store"
 )
 
-// topConsumerWindow is how recent a container sample must be to count toward
+// topConsumerMinWindow is how recent a container sample must be to count toward
 // the "top consumers" list. Scaled with the collector interval (read from
 // settings) so it stays meaningful even when sampling is sparse.
 const topConsumerMinWindow = 2 * time.Minute
 
 // TopContainerSample augments a stats sample with the human-readable owner
-// name so the UI can show "project/stage" or the static-site name without an
-// extra round-trip per row.
+// name so the UI can show "workload/role" without an extra round-trip per row.
 type TopContainerSample struct {
 	store.ContainerStatsSample
 	OwnerName string `json:"owner_name"`
@@ -90,107 +85,6 @@ func (s *Server) getSystemStatsHistory(w http.ResponseWriter, r *http.Request) {
 	respondJSON(w, http.StatusOK, samples)
 }
 
-// getInstanceStatsHistory handles GET /api/projects/{id}/stages/{stage}/instances/{iid}/stats/history.
-// {iid} is the container row ID (same UUID as the legacy instance ID).
-func (s *Server) getInstanceStatsHistory(w http.ResponseWriter, r *http.Request) {
-	instanceID := chi.URLParam(r, "iid")
-	if _, err := s.store.GetContainerByID(instanceID); err != nil {
-		if errors.Is(err, store.ErrNotFound) {
-			respondNotFound(w, "container")
-			return
-		}
-		slog.Error("failed to get container", "id", instanceID, "error", err)
-		respondError(w, http.StatusInternalServerError, "failed to get container")
-		return
-	}
-	samples, err := s.store.ListContainerStatsSamples(stats.OwnerTypeInstance, instanceID, sinceTimestamp(parseWindow(r)))
-	if err != nil {
-		slog.Error("failed to list instance stats samples", "instance_id", instanceID, "error", err)
-		respondError(w, http.StatusInternalServerError, "failed to list samples")
-		return
-	}
-	if samples == nil {
-		samples = []store.ContainerStatsSample{}
-	}
-	respondJSON(w, http.StatusOK, samples)
-}
-
-// getStaticSiteStats handles GET /api/sites/{id}/stats — current snapshot.
-func (s *Server) getStaticSiteStats(w http.ResponseWriter, r *http.Request) {
-	id := chi.URLParam(r, "id")
-	site, err := s.store.GetStaticSiteByID(id)
-	if err != nil {
-		if errors.Is(err, store.ErrNotFound) {
-			respondNotFound(w, "site")
-			return
-		}
-		slog.Error("failed to get site", "site_id", id, "error", err)
-		respondError(w, http.StatusInternalServerError, "failed to get site")
-		return
-	}
-	if site.ContainerID == "" {
-		respondError(w, http.StatusConflict, "site has no container")
-		return
-	}
-	if s.docker == nil {
-		respondError(w, http.StatusServiceUnavailable, "Docker is not available")
-		return
-	}
-	cs, err := s.docker.GetContainerStats(r.Context(), site.ContainerID)
-	if err != nil {
-		slog.Error("failed to get site stats", "site_id", id, "error", err)
-		respondError(w, http.StatusInternalServerError, "failed to get site stats")
-		return
-	}
-	respondJSON(w, http.StatusOK, cs)
-}
-
-// getStaticSiteStatsHistory handles GET /api/sites/{id}/stats/history.
-func (s *Server) getStaticSiteStatsHistory(w http.ResponseWriter, r *http.Request) {
-	id := chi.URLParam(r, "id")
-	if _, err := s.store.GetStaticSiteByID(id); err != nil {
-		if errors.Is(err, store.ErrNotFound) {
-			respondNotFound(w, "site")
-			return
-		}
-		slog.Error("failed to get site", "site_id", id, "error", err)
-		respondError(w, http.StatusInternalServerError, "failed to get site")
-		return
-	}
-	samples, err := s.store.ListContainerStatsSamples(stats.OwnerTypeSite, id, sinceTimestamp(parseWindow(r)))
-	if err != nil {
-		slog.Error("failed to list site stats samples", "site_id", id, "error", err)
-		respondError(w, http.StatusInternalServerError, "failed to list samples")
-		return
-	}
-	if samples == nil {
-		samples = []store.ContainerStatsSample{}
-	}
-	respondJSON(w, http.StatusOK, samples)
-}
-
-// streamStaticSiteLogs handles GET /api/sites/{id}/logs?tail=200&follow=true.
-// Reuses the shared container log streamer so the SSE + multiplex handling
-// matches /api/projects/.../instances/.../logs exactly.
-func (s *Server) streamStaticSiteLogs(w http.ResponseWriter, r *http.Request) {
-	id := chi.URLParam(r, "id")
-	site, err := s.store.GetStaticSiteByID(id)
-	if err != nil {
-		if errors.Is(err, store.ErrNotFound) {
-			respondNotFound(w, "site")
-			return
-		}
-		slog.Error("failed to get site", "site_id", id, "error", err)
-		respondError(w, http.StatusInternalServerError, "failed to get site")
-		return
-	}
-	if site.ContainerID == "" {
-		respondError(w, http.StatusConflict, "site has no container")
-		return
-	}
-	s.streamLogsForContainer(w, r, site.ContainerID)
-}
-
 // listTopContainers handles GET /api/system/stats/top?limit=5&by=cpu.
 // Returns the top-N most recent samples across containers, sorted by CPU or
 // memory. Container IDs are stripped for non-admins so a low-privilege viewer
@@ -246,8 +140,6 @@ func (s *Server) listTopContainers(w http.ResponseWriter, r *http.Request) {
 		top = top[:limit]
 	}
 
-	// Resolve owner names so the UI can show "project/stage" or the site name
-	// without a per-row round trip.
 	enriched := s.enrichWithOwnerNames(top)
 
 	// Scrub container IDs for non-admins. The owner name is the actionable
@@ -264,18 +156,13 @@ func (s *Server) listTopContainers(w http.ResponseWriter, r *http.Request) {
 }
 
 // enrichWithOwnerNames attaches a human-readable owner name to each sample.
-// Looks up instances and sites in batch so the cost is independent of the
-// number of samples (which is at most 'limit').
+// Names are resolved through the containers index → workloads, which after
+// the cutover is the only available lookup path.
 func (s *Server) enrichWithOwnerNames(samples []store.ContainerStatsSample) []TopContainerSample {
 	out := make([]TopContainerSample, len(samples))
 	for i, sm := range samples {
 		out[i] = TopContainerSample{ContainerStatsSample: sm}
-		switch sm.OwnerType {
-		case stats.OwnerTypeInstance:
-			out[i].OwnerName = s.lookupInstanceName(sm.OwnerID)
-		case stats.OwnerTypeSite:
-			out[i].OwnerName = s.lookupSiteName(sm.OwnerID)
-		}
+		out[i].OwnerName = s.lookupInstanceName(sm.OwnerID)
 	}
 	return out
 }
@@ -300,11 +187,3 @@ func (s *Server) lookupInstanceName(instanceID string) string {
 	return w.Name
 }
 
-// lookupSiteName returns the site's display name or empty on lookup error.
-func (s *Server) lookupSiteName(siteID string) string {
-	site, err := s.store.GetStaticSiteByID(siteID)
-	if err != nil {
-		return ""
-	}
-	return site.Name
-}