feat(cutover): hard legacy cutover — drop projects/stacks/sites/deploys

The clean-break delete that closes the workload-first refactor arc.
Net diff: ~30 backend files deleted, ~20 modified, ~12k LOC removed
on the Go side; entire /projects /stacks /sites /deploy frontend
trees gone; ~6.7k LOC removed on the Svelte/TypeScript side.

Backend
- API handlers gone: internal/api/{projects,stages,stage_env,stacks,
  static_sites,deploys,instances,volume_browser}.go
- Store CRUD + tests gone: internal/store/{projects,stages,stage_env,
  stacks,static_sites,static_site_secrets,deploys,poll_state,volumes,
  workload_sync}.go (+ _test.go siblings)
- Legacy deployer pipeline gone: internal/deployer/{bluegreen,promote,
  rollback,subdomain,resolver_test}.go; deployer.go trimmed to just the
  dispatch surface used by the plugin pipeline
- internal/staticsite/{manager,healthcheck}.go and
  internal/stack/manager.go gone (the rest of those packages stay as
  helpers imported by the static + compose plugins)
- internal/registry/poller.go gone (legacy registry poller)
- internal/volume.ResolvePath gone; ResolveWorkloadPath stays
- internal/webhook: handleWebhook (project) + handleSiteWebhook (site)
  gone; only POST /api/webhook/triggers/{secret} remains
- workload-side webhook URL handlers (getWorkloadWebhook +
  regenerateWorkloadWebhook + EnsureWorkloadWebhookSecret +
  SetWorkloadWebhookSecret + GetWorkloadByWebhookSecret) gone — they
  minted URLs that would 404 against the new trigger-only ingress
- cmd/server/main.go: dropped staticsite.Manager, stack.Manager,
  staticsite.HealthChecker, registry poller, SetSiteSyncTriggerer,
  SetStaticSiteManager, SetStackManager, wireStaticBackend
- store/store.go: idempotent DROP TABLE IF EXISTS for every legacy
  table (projects, stages, stage_env, volumes, deploys, deploy_logs,
  poll_states, stacks, stack_revisions, stack_deploys, static_sites,
  static_site_secrets); FK order children-then-parents
- store/models.go: dropped Project, Stage, Deploy, DeployLog, StageEnv,
  Volume, StaticSite, StaticSiteSecret, Stack, StackRevision,
  StackDeploy types; kept WorkloadKind constants as documented strings
- internal/store/helpers.go (new): BoolToInt, rowScanner,
  GenerateWebhookSecret extracted from deleted CRUD files
- internal/api/secrets.go (new): forwards to store.GenerateWebhookSecret
  so api + store paths share one secret-generation impl (no
  panic-vs-UUID-fallback divergence)
- internal/reconciler/reconciler.go: dropped legacy stack-by-compose
  + static-site label paths; only canonical tinyforge.workload.id
  dispatch remains
- providers (gitea_content/github_provider/gitlab_provider) gained
  path-traversal rejection on every tree entry
- internal/webhook ParsedImage / ParseImageRef demoted to package-
  private (no external callers)

Frontend
- /projects /stacks /sites /deploy routes deleted (entire trees)
- ProjectCard / InstanceCard / StaleContainerCard components deleted
- api.ts: dropped every project/stage/stack/site/deploy/instance
  helper + types (Project, Stage, Stack, StaticSite, Deploy,
  Instance, Volume, etc.); kept Workload, Container, App, Settings,
  Registry, EventTrigger, LogScanRule, webhook envelopes
- WorkloadWebhook type + getWorkloadWebhook/regenerateWorkloadWebhook
  api functions gone (mirror of the backend deletion above)
- web/src/routes/+layout.svelte: dropped /projects /sites /stacks
  /deploy nav entries, trimmed quick-nav keymap
- web/src/routes/+page.svelte: dashboard rewrite — reads
  listWorkloads + listContainers only; 4-card stat grid
  (workloads/running/failed/stale) + recent workloads strip
- navCounts.ts, SystemHealthCard.svelte, ContainerLogs.svelte,
  ContainerStats.svelte, StatusBadge.svelte, TagCombobox.svelte,
  proxies/+page.svelte, containers/+page.svelte all rewired to the
  workload-first surface
- AbortController plumbing on dashboard, nav-counts, stale page,
  SystemHealthCard so navigation doesn't leave dangling fetches
- i18n: dropped projects.*, projectDetail.*, envEditor.*,
  volumeEditor.*, volumeBrowser.*, quickDeploy.*, sites.*, stacks.*,
  instance.*, confirm.* namespaces; en/ru parity preserved (1042
  keys each)

Hardening from go-reviewer + security-reviewer + typescript-reviewer
subagent passes (0 CRITICAL across all three; 1 HIGH + ~12 MEDIUM
addressed inline before commit):

- Sec H1: dead-end workload webhook URL handlers (would mint URLs
  that 404 the new trigger-only ingress) deleted across backend +
  frontend
- Go M1: IsTerminalDeployStatus dropped (no production callers)
- Go M2: ParsedImage/ParseImageRef lowercased (in-package only)
- Go M6: generateWebhookSecret unified — api shim forwards to
  store.GenerateWebhookSecret
- Doc/comment freshness: stage_id (no longer FK), ProxyRoute legacy
  field names, workloadIDRow rationale, webhook_deliveries.target_type
  enum, WebhookDeliveryLog component header

Doc
- WORKLOAD_REFACTOR_TODO: cutover marked DONE; all three Priority 1
  items are now shipped. Next focus is Priority 3 polish (apps.* i18n
  + codemap entries) and Priority 4 tests.

Behavioral notes for operators upgrading from a pre-cutover build
- Existing rows in the dropped tables disappear on first boot.
- Legacy webhook URLs at /api/webhook/{secret} and
  /api/webhook/sites/{secret} return 404; CI configs must repoint to
  /api/webhook/triggers/{secret} (the trigger-split boot backfill
  lifted any embedded workload secret onto a Trigger row, so the
  secret value itself carries over).
- Frontend routes /projects /stacks /sites /deploy are gone; nav
  links replaced with /apps and /triggers.

internal/store/containers.go

@@ -187,23 +187,22 @@ func (s *Store) GetContainerByDockerID(dockerID string) (Container, error) {
 	return c, nil
 }
 
-// ListProxyRoutes returns proxy-enabled project containers joined with
-// project + stage names. Reads from the normalized containers index and
-// joins through stage_id so a stage rename does not orphan the row's view.
-//
-// Source is reported as "instance" for back-compat with the Proxies page
-// filter (the frontend keys off the literal string).
+// ListProxyRoutes returns proxy-enabled containers joined with their
+// owning workload's name. The legacy stages join is gone — Role is used
+// as the StageName fallback so the Proxies page still reads naturally
+// for project-style workloads. Source is reported as "instance" for
+// back-compat with the Proxies page filter (the frontend keys off the
+// literal string).
 func (s *Store) ListProxyRoutes(domain string) ([]ProxyRoute, error) {
 	rows, err := s.db.Query(`
-		SELECT c.id, p.id, p.name, s.id, s.name,
+		SELECT c.id, w.id, w.name,
 		       c.image_tag, c.subdomain, c.container_id, c.port,
-		       c.proxy_route_id, c.npm_proxy_id, c.state, c.created_at
+		       c.proxy_route_id, c.npm_proxy_id, c.state, c.created_at,
+		       c.role, c.stage_id
 		FROM containers c
-		JOIN workloads w ON w.id = c.workload_id AND w.kind = 'project'
-		JOIN projects   p ON p.id = w.ref_id
-		JOIN stages     s ON s.id = c.stage_id OR (c.stage_id = '' AND s.project_id = p.id AND s.name = c.role)
+		JOIN workloads w ON w.id = c.workload_id
 		WHERE c.subdomain != '' AND (c.proxy_route_id != '' OR c.npm_proxy_id > 0)
-		ORDER BY p.name, s.name, c.created_at DESC`,
+		ORDER BY w.name, c.role, c.created_at DESC`,
 	)
 	if err != nil {
 		return nil, fmt.Errorf("query proxy routes: %w", err)
@@ -213,14 +212,18 @@ func (s *Store) ListProxyRoutes(domain string) ([]ProxyRoute, error) {
 	routes := []ProxyRoute{}
 	for rows.Next() {
 		var r ProxyRoute
+		var role, stageID string
 		if err := rows.Scan(
-			&r.InstanceID, &r.ProjectID, &r.ProjectName, &r.StageID, &r.StageName,
+			&r.InstanceID, &r.ProjectID, &r.ProjectName,
 			&r.ImageTag, &r.Subdomain, &r.ContainerID, &r.Port,
 			&r.ProxyRouteID, &r.NpmProxyID, &r.Status, &r.CreatedAt,
+			&role, &stageID,
 		); err != nil {
 			return nil, fmt.Errorf("scan proxy route: %w", err)
 		}
 		r.Source = "instance"
+		r.StageID = stageID
+		r.StageName = role
 		if domain != "" && r.Subdomain != "" {
 			r.Domain = r.Subdomain + "." + domain
 		}
@@ -229,40 +232,6 @@ func (s *Store) ListProxyRoutes(domain string) ([]ProxyRoute, error) {
 	return routes, rows.Err()
 }
 
-// ListContainersByStageID returns project containers for the given stage,
-// newest first. Resolves via stage_id with a fallback to the legacy
-// (stage.name = container.role) join for rows written before the stage_id
-// column was populated. Replaces GetInstancesByStageID.
-func (s *Store) ListContainersByStageID(stageID string) ([]Container, error) {
-	rows, err := s.db.Query(`
-		SELECT `+prefixCols(containerColumns, "c.")+`
-		FROM containers c
-		LEFT JOIN stages s ON s.id = ?
-		WHERE c.stage_id = ?
-		   OR (c.stage_id = '' AND s.id IS NOT NULL
-		       AND c.role = s.name
-		       AND EXISTS (
-		           SELECT 1 FROM workloads w
-		           WHERE w.id = c.workload_id
-		             AND w.kind = 'project'
-		             AND w.ref_id = s.project_id))
-		ORDER BY c.created_at DESC`, stageID, stageID)
-	if err != nil {
-		return nil, fmt.Errorf("query containers by stage: %w", err)
-	}
-	defer rows.Close()
-
-	out := []Container{}
-	for rows.Next() {
-		c, err := scanContainer(rows)
-		if err != nil {
-			return nil, fmt.Errorf("scan container: %w", err)
-		}
-		out = append(out, c)
-	}
-	return out, rows.Err()
-}
-
 // ListContainersByWorkload returns all containers for a given workload, newest first.
 func (s *Store) ListContainersByWorkload(workloadID string) ([]Container, error) {
 	rows, err := s.db.Query(