feat(cutover): hard legacy cutover — drop projects/stacks/sites/deploys

The clean-break delete that closes the workload-first refactor arc.
Net diff: ~30 backend files deleted, ~20 modified, ~12k LOC removed
on the Go side; entire /projects /stacks /sites /deploy frontend
trees gone; ~6.7k LOC removed on the Svelte/TypeScript side.

Backend
- API handlers gone: internal/api/{projects,stages,stage_env,stacks,
  static_sites,deploys,instances,volume_browser}.go
- Store CRUD + tests gone: internal/store/{projects,stages,stage_env,
  stacks,static_sites,static_site_secrets,deploys,poll_state,volumes,
  workload_sync}.go (+ _test.go siblings)
- Legacy deployer pipeline gone: internal/deployer/{bluegreen,promote,
  rollback,subdomain,resolver_test}.go; deployer.go trimmed to just the
  dispatch surface used by the plugin pipeline
- internal/staticsite/{manager,healthcheck}.go and
  internal/stack/manager.go gone (the rest of those packages stay as
  helpers imported by the static + compose plugins)
- internal/registry/poller.go gone (legacy registry poller)
- internal/volume.ResolvePath gone; ResolveWorkloadPath stays
- internal/webhook: handleWebhook (project) + handleSiteWebhook (site)
  gone; only POST /api/webhook/triggers/{secret} remains
- workload-side webhook URL handlers (getWorkloadWebhook +
  regenerateWorkloadWebhook + EnsureWorkloadWebhookSecret +
  SetWorkloadWebhookSecret + GetWorkloadByWebhookSecret) gone — they
  minted URLs that would 404 against the new trigger-only ingress
- cmd/server/main.go: dropped staticsite.Manager, stack.Manager,
  staticsite.HealthChecker, registry poller, SetSiteSyncTriggerer,
  SetStaticSiteManager, SetStackManager, wireStaticBackend
- store/store.go: idempotent DROP TABLE IF EXISTS for every legacy
  table (projects, stages, stage_env, volumes, deploys, deploy_logs,
  poll_states, stacks, stack_revisions, stack_deploys, static_sites,
  static_site_secrets); FK order children-then-parents
- store/models.go: dropped Project, Stage, Deploy, DeployLog, StageEnv,
  Volume, StaticSite, StaticSiteSecret, Stack, StackRevision,
  StackDeploy types; kept WorkloadKind constants as documented strings
- internal/store/helpers.go (new): BoolToInt, rowScanner,
  GenerateWebhookSecret extracted from deleted CRUD files
- internal/api/secrets.go (new): forwards to store.GenerateWebhookSecret
  so api + store paths share one secret-generation impl (no
  panic-vs-UUID-fallback divergence)
- internal/reconciler/reconciler.go: dropped legacy stack-by-compose
  + static-site label paths; only canonical tinyforge.workload.id
  dispatch remains
- providers (gitea_content/github_provider/gitlab_provider) gained
  path-traversal rejection on every tree entry
- internal/webhook ParsedImage / ParseImageRef demoted to package-
  private (no external callers)

Frontend
- /projects /stacks /sites /deploy routes deleted (entire trees)
- ProjectCard / InstanceCard / StaleContainerCard components deleted
- api.ts: dropped every project/stage/stack/site/deploy/instance
  helper + types (Project, Stage, Stack, StaticSite, Deploy,
  Instance, Volume, etc.); kept Workload, Container, App, Settings,
  Registry, EventTrigger, LogScanRule, webhook envelopes
- WorkloadWebhook type + getWorkloadWebhook/regenerateWorkloadWebhook
  api functions gone (mirror of the backend deletion above)
- web/src/routes/+layout.svelte: dropped /projects /sites /stacks
  /deploy nav entries, trimmed quick-nav keymap
- web/src/routes/+page.svelte: dashboard rewrite — reads
  listWorkloads + listContainers only; 4-card stat grid
  (workloads/running/failed/stale) + recent workloads strip
- navCounts.ts, SystemHealthCard.svelte, ContainerLogs.svelte,
  ContainerStats.svelte, StatusBadge.svelte, TagCombobox.svelte,
  proxies/+page.svelte, containers/+page.svelte all rewired to the
  workload-first surface
- AbortController plumbing on dashboard, nav-counts, stale page,
  SystemHealthCard so navigation doesn't leave dangling fetches
- i18n: dropped projects.*, projectDetail.*, envEditor.*,
  volumeEditor.*, volumeBrowser.*, quickDeploy.*, sites.*, stacks.*,
  instance.*, confirm.* namespaces; en/ru parity preserved (1042
  keys each)

Hardening from go-reviewer + security-reviewer + typescript-reviewer
subagent passes (0 CRITICAL across all three; 1 HIGH + ~12 MEDIUM
addressed inline before commit):

- Sec H1: dead-end workload webhook URL handlers (would mint URLs
  that 404 the new trigger-only ingress) deleted across backend +
  frontend
- Go M1: IsTerminalDeployStatus dropped (no production callers)
- Go M2: ParsedImage/ParseImageRef lowercased (in-package only)
- Go M6: generateWebhookSecret unified — api shim forwards to
  store.GenerateWebhookSecret
- Doc/comment freshness: stage_id (no longer FK), ProxyRoute legacy
  field names, workloadIDRow rationale, webhook_deliveries.target_type
  enum, WebhookDeliveryLog component header

Doc
- WORKLOAD_REFACTOR_TODO: cutover marked DONE; all three Priority 1
  items are now shipped. Next focus is Priority 3 polish (apps.* i18n
  + codemap entries) and Priority 4 tests.

Behavioral notes for operators upgrading from a pre-cutover build
- Existing rows in the dropped tables disappear on first boot.
- Legacy webhook URLs at /api/webhook/{secret} and
  /api/webhook/sites/{secret} return 404; CI configs must repoint to
  /api/webhook/triggers/{secret} (the trigger-split boot backfill
  lifted any embedded workload secret onto a Trigger row, so the
  secret value itself carries over).
- Frontend routes /projects /stacks /sites /deploy are gone; nav
  links replaced with /apps and /triggers.

internal/registry/poller.go

@@ -1,189 +0,0 @@
-package registry
-
-import (
-	"context"
-	"fmt"
-	"log/slog"
-	"sync"
-	"time"
-
-	"github.com/alexei/tinyforge/internal/crypto"
-	"github.com/alexei/tinyforge/internal/store"
-	"github.com/robfig/cron/v3"
-)
-
-// Poller periodically checks registries for new image tags and triggers
-// deployments for stages with auto_deploy enabled.
-type Poller struct {
-	store     *store.Store
-	deployer  DeployTriggerer
-	encKey    [32]byte
-	cron      *cron.Cron
-	mu        sync.Mutex
-	entryID   cron.EntryID
-	running   bool
-}
-
-// NewPoller creates a new Poller instance.
-func NewPoller(st *store.Store, deployer DeployTriggerer, encKey [32]byte) *Poller {
-	return &Poller{
-		store:    st,
-		deployer: deployer,
-		encKey:   encKey,
-		cron:     cron.New(),
-	}
-}
-
-// Start begins the polling scheduler with the given interval string (e.g., "5m", "1h").
-// If the poller is already running, it stops and restarts with the new interval.
-func (p *Poller) Start(interval string) error {
-	p.mu.Lock()
-	defer p.mu.Unlock()
-
-	duration, err := time.ParseDuration(interval)
-	if err != nil {
-		return fmt.Errorf("parse polling interval %q: %w", interval, err)
-	}
-
-	// Stop existing schedule if running.
-	if p.running {
-		p.cron.Remove(p.entryID)
-	}
-
-	// Convert duration to a cron schedule: @every <duration>.
-	spec := fmt.Sprintf("@every %s", duration.String())
-	entryID, err := p.cron.AddFunc(spec, func() {
-		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
-		defer cancel()
-		if pollErr := p.poll(ctx); pollErr != nil {
-			slog.Warn("poller: poll error", "error", pollErr)
-		}
-	})
-	if err != nil {
-		return fmt.Errorf("schedule poller: %w", err)
-	}
-
-	p.entryID = entryID
-	if !p.running {
-		p.cron.Start()
-	}
-	p.running = true
-
-	slog.Info("poller started", "interval", duration.String())
-	return nil
-}
-
-// Stop gracefully shuts down the poller.
-func (p *Poller) Stop() {
-	p.mu.Lock()
-	defer p.mu.Unlock()
-
-	if p.running {
-		ctx := p.cron.Stop()
-		<-ctx.Done()
-		p.running = false
-		slog.Info("poller stopped")
-	}
-}
-
-// poll performs a single polling cycle: iterates over all projects and their
-// stages, checks for new tags, and triggers deploys where appropriate.
-func (p *Poller) poll(ctx context.Context) error {
-	projects, err := p.store.GetAllProjects()
-	if err != nil {
-		return fmt.Errorf("get projects: %w", err)
-	}
-
-	for _, project := range projects {
-		if err := p.pollProject(ctx, project); err != nil {
-			slog.Warn("poller: project error", "project", project.Name, "id", project.ID, "error", err)
-		}
-	}
-	return nil
-}
-
-// pollProject checks all stages of a single project for new tags.
-func (p *Poller) pollProject(ctx context.Context, project store.Project) error {
-	if project.Registry == "" {
-		return nil
-	}
-
-	reg, err := p.store.GetRegistryByName(project.Registry)
-	if err != nil {
-		return fmt.Errorf("get registry %s: %w", project.Registry, err)
-	}
-
-	token, err := crypto.Decrypt(p.encKey, reg.Token)
-	if err != nil {
-		token = reg.Token
-	}
-
-	client, err := NewClient(reg.Type, reg.URL, token)
-	if err != nil {
-		return fmt.Errorf("create registry client: %w", err)
-	}
-
-	tags, err := client.ListTags(ctx, project.Image)
-	if err != nil {
-		return fmt.Errorf("list tags for %s: %w", project.Image, err)
-	}
-
-	stages, err := p.store.GetStagesByProjectID(project.ID)
-	if err != nil {
-		return fmt.Errorf("get stages for project %s: %w", project.ID, err)
-	}
-
-	for _, stage := range stages {
-		if err := p.pollStage(ctx, project, stage, tags); err != nil {
-			slog.Warn("poller: stage error", "project", project.Name, "stage", stage.Name, "error", err)
-		}
-	}
-	return nil
-}
-
-// pollStage checks a single stage for new tags and triggers deploy if needed.
-func (p *Poller) pollStage(ctx context.Context, project store.Project, stage store.Stage, allTags []string) error {
-	latest, err := LatestTag(allTags, stage.TagPattern)
-	if err != nil {
-		return fmt.Errorf("match tags for stage %s: %w", stage.Name, err)
-	}
-	if latest == "" {
-		return nil
-	}
-
-	state, err := p.store.GetPollState(stage.ID)
-	if err != nil {
-		return p.store.UpsertPollState(store.PollState{
-			StageID:    stage.ID,
-			LastTag:    latest,
-			LastPolled: store.Now(),
-		})
-	}
-
-	defer func() {
-		if err := p.store.UpsertPollState(store.PollState{
-			StageID:    stage.ID,
-			LastTag:    latest,
-			LastPolled: store.Now(),
-		}); err != nil {
-			slog.Warn("poller: failed to update poll state", "stage_id", stage.ID, "error", err)
-		}
-	}()
-
-	if state.LastTag == latest {
-		return nil
-	}
-
-	slog.Info("poller: new tag detected", "tag", latest, "project", project.Name, "stage", stage.Name, "previous", state.LastTag)
-
-	if !stage.AutoDeploy {
-		slog.Info("poller: auto_deploy disabled, skipping", "stage", stage.Name)
-		return nil
-	}
-
-	if err := p.deployer.TriggerDeploy(ctx, project.ID, stage.ID, latest); err != nil {
-		return fmt.Errorf("trigger deploy for tag %s: %w", latest, err)
-	}
-
-	return nil
-}

internal/registry/registry.go

@@ -29,13 +29,6 @@ type Client interface {
 	ListImages(ctx context.Context, owner string) ([]RegistryImage, error)
 }
 
-// DeployTriggerer is called by the poller when a new tag is detected for a
-// stage with auto_deploy enabled. This decouples the registry package from the
-// deployer implementation.
-type DeployTriggerer interface {
-	TriggerDeploy(ctx context.Context, projectID, stageID, imageTag string) error
-}
-
 // MatchTags filters a list of tags, returning only those that match the given
 // glob pattern. Pattern matching uses path.Match semantics (*, ?, []).
 // Returns an error if the pattern is malformed.