feat(cutover): hard legacy cutover — drop projects/stacks/sites/deploys

The clean-break delete that closes the workload-first refactor arc.
Net diff: ~30 backend files deleted, ~20 modified, ~12k LOC removed
on the Go side; entire /projects /stacks /sites /deploy frontend
trees gone; ~6.7k LOC removed on the Svelte/TypeScript side.

Backend
- API handlers gone: internal/api/{projects,stages,stage_env,stacks,
  static_sites,deploys,instances,volume_browser}.go
- Store CRUD + tests gone: internal/store/{projects,stages,stage_env,
  stacks,static_sites,static_site_secrets,deploys,poll_state,volumes,
  workload_sync}.go (+ _test.go siblings)
- Legacy deployer pipeline gone: internal/deployer/{bluegreen,promote,
  rollback,subdomain,resolver_test}.go; deployer.go trimmed to just the
  dispatch surface used by the plugin pipeline
- internal/staticsite/{manager,healthcheck}.go and
  internal/stack/manager.go gone (the rest of those packages stay as
  helpers imported by the static + compose plugins)
- internal/registry/poller.go gone (legacy registry poller)
- internal/volume.ResolvePath gone; ResolveWorkloadPath stays
- internal/webhook: handleWebhook (project) + handleSiteWebhook (site)
  gone; only POST /api/webhook/triggers/{secret} remains
- workload-side webhook URL handlers (getWorkloadWebhook +
  regenerateWorkloadWebhook + EnsureWorkloadWebhookSecret +
  SetWorkloadWebhookSecret + GetWorkloadByWebhookSecret) gone — they
  minted URLs that would 404 against the new trigger-only ingress
- cmd/server/main.go: dropped staticsite.Manager, stack.Manager,
  staticsite.HealthChecker, registry poller, SetSiteSyncTriggerer,
  SetStaticSiteManager, SetStackManager, wireStaticBackend
- store/store.go: idempotent DROP TABLE IF EXISTS for every legacy
  table (projects, stages, stage_env, volumes, deploys, deploy_logs,
  poll_states, stacks, stack_revisions, stack_deploys, static_sites,
  static_site_secrets); FK order children-then-parents
- store/models.go: dropped Project, Stage, Deploy, DeployLog, StageEnv,
  Volume, StaticSite, StaticSiteSecret, Stack, StackRevision,
  StackDeploy types; kept WorkloadKind constants as documented strings
- internal/store/helpers.go (new): BoolToInt, rowScanner,
  GenerateWebhookSecret extracted from deleted CRUD files
- internal/api/secrets.go (new): forwards to store.GenerateWebhookSecret
  so api + store paths share one secret-generation impl (no
  panic-vs-UUID-fallback divergence)
- internal/reconciler/reconciler.go: dropped legacy stack-by-compose
  + static-site label paths; only canonical tinyforge.workload.id
  dispatch remains
- providers (gitea_content/github_provider/gitlab_provider) gained
  path-traversal rejection on every tree entry
- internal/webhook ParsedImage / ParseImageRef demoted to package-
  private (no external callers)

Frontend
- /projects /stacks /sites /deploy routes deleted (entire trees)
- ProjectCard / InstanceCard / StaleContainerCard components deleted
- api.ts: dropped every project/stage/stack/site/deploy/instance
  helper + types (Project, Stage, Stack, StaticSite, Deploy,
  Instance, Volume, etc.); kept Workload, Container, App, Settings,
  Registry, EventTrigger, LogScanRule, webhook envelopes
- WorkloadWebhook type + getWorkloadWebhook/regenerateWorkloadWebhook
  api functions gone (mirror of the backend deletion above)
- web/src/routes/+layout.svelte: dropped /projects /sites /stacks
  /deploy nav entries, trimmed quick-nav keymap
- web/src/routes/+page.svelte: dashboard rewrite — reads
  listWorkloads + listContainers only; 4-card stat grid
  (workloads/running/failed/stale) + recent workloads strip
- navCounts.ts, SystemHealthCard.svelte, ContainerLogs.svelte,
  ContainerStats.svelte, StatusBadge.svelte, TagCombobox.svelte,
  proxies/+page.svelte, containers/+page.svelte all rewired to the
  workload-first surface
- AbortController plumbing on dashboard, nav-counts, stale page,
  SystemHealthCard so navigation doesn't leave dangling fetches
- i18n: dropped projects.*, projectDetail.*, envEditor.*,
  volumeEditor.*, volumeBrowser.*, quickDeploy.*, sites.*, stacks.*,
  instance.*, confirm.* namespaces; en/ru parity preserved (1042
  keys each)

Hardening from go-reviewer + security-reviewer + typescript-reviewer
subagent passes (0 CRITICAL across all three; 1 HIGH + ~12 MEDIUM
addressed inline before commit):

- Sec H1: dead-end workload webhook URL handlers (would mint URLs
  that 404 the new trigger-only ingress) deleted across backend +
  frontend
- Go M1: IsTerminalDeployStatus dropped (no production callers)
- Go M2: ParsedImage/ParseImageRef lowercased (in-package only)
- Go M6: generateWebhookSecret unified — api shim forwards to
  store.GenerateWebhookSecret
- Doc/comment freshness: stage_id (no longer FK), ProxyRoute legacy
  field names, workloadIDRow rationale, webhook_deliveries.target_type
  enum, WebhookDeliveryLog component header

Doc
- WORKLOAD_REFACTOR_TODO: cutover marked DONE; all three Priority 1
  items are now shipped. Next focus is Priority 3 polish (apps.* i18n
  + codemap entries) and Priority 4 tests.

Behavioral notes for operators upgrading from a pre-cutover build
- Existing rows in the dropped tables disappear on first boot.
- Legacy webhook URLs at /api/webhook/{secret} and
  /api/webhook/sites/{secret} return 404; CI configs must repoint to
  /api/webhook/triggers/{secret} (the trigger-split boot backfill
  lifted any embedded workload secret onto a Trigger row, so the
  secret value itself carries over).
- Frontend routes /projects /stacks /sites /deploy are gone; nav
  links replaced with /apps and /triggers.

internal/store/models.go

@@ -1,45 +1,5 @@
 package store
 
-// Project represents a deployable application.
-type Project struct {
-	ID          string `json:"id"`
-	Name        string `json:"name"`
-	Registry    string `json:"registry"`
-	Image       string `json:"image"`
-	Port        int    `json:"port"`
-	Healthcheck string `json:"healthcheck"`
-	Env              string `json:"env"`     // JSON-encoded map
-	Volumes          string `json:"volumes"` // JSON-encoded map
-	NpmAccessListID     int    `json:"npm_access_list_id"` // per-project override, 0 = use global
-	WebhookSecret       string `json:"-"`                  // per-project webhook secret (URL identifier); never serialized
-	WebhookSigningSecret    string `json:"-"`                       // HMAC-SHA256 key for inbound webhook signature verification; never serialized
-	WebhookRequireSignature bool   `json:"webhook_require_signature"` // if true, reject unsigned/invalid-sig webhook requests
-	NotificationURL     string `json:"notification_url"`    // outgoing webhook target; empty = inherit from settings
-	NotificationSecret  string `json:"-"`                  // outgoing-webhook signing secret; never serialized directly
-	CreatedAt        string `json:"created_at"`
-	UpdatedAt        string `json:"updated_at"`
-}
-
-// Stage represents a deployment stage within a project (e.g. dev, rel, prod).
-type Stage struct {
-	ID           string `json:"id"`
-	ProjectID    string `json:"project_id"`
-	Name         string `json:"name"`
-	TagPattern   string `json:"tag_pattern"`
-	AutoDeploy   bool   `json:"auto_deploy"`
-	MaxInstances int    `json:"max_instances"`
-	Confirm      bool   `json:"confirm"`
-	EnableProxy  bool    `json:"enable_proxy"`
-	PromoteFrom  string  `json:"promote_from"`
-	Subdomain          string  `json:"subdomain"`
-	NotificationURL    string  `json:"notification_url"`
-	NotificationSecret string  `json:"-"` // outgoing-webhook signing secret; never serialized directly
-	CpuLimit        float64 `json:"cpu_limit"`    // CPU cores (e.g., 0.5, 1, 2), 0 = unlimited
-	MemoryLimit     int     `json:"memory_limit"` // megabytes, 0 = unlimited
-	CreatedAt       string `json:"created_at"`
-	UpdatedAt       string `json:"updated_at"`
-}
-
 // Registry represents a container image registry.
 type Registry struct {
 	ID        string `json:"id"`
@@ -142,10 +102,15 @@ type DNSRecord struct {
 	UpdatedAt        string `json:"updated_at"`
 }
 
-// ProxyRoute is a proxy-enabled container row joined with its project + stage
-// names, shaped for the Proxies page. Source is "instance" for project
-// containers and "static_site" for site rows — the names are historical
-// (the table itself was renamed to containers in the workload refactor).
+// ProxyRoute shapes one proxy-enabled container row for the Proxies
+// page. The legacy field names (ProjectID, ProjectName, StageID,
+// StageName, InstanceID) are retained verbatim for the existing
+// frontend contract — after the workload-first cutover they map to:
+//   ProjectID/Name → workload id / workload name
+//   StageID/Name   → containers.stage_id / containers.role
+//   InstanceID     → container row id
+//   Source         → "instance" for image/compose, "static_site" for static
+// Renaming would require a coordinated frontend change; deferred.
 type ProxyRoute struct {
 	Source       string `json:"source"`
 	InstanceID   string `json:"instance_id"`
@@ -164,39 +129,6 @@ type ProxyRoute struct {
 	CreatedAt    string `json:"created_at"`
 }
 
-// Deploy represents a deployment attempt.
-type Deploy struct {
-	ID         string `json:"id"`
-	ProjectID  string `json:"project_id"`
-	StageID    string `json:"stage_id"`
-	InstanceID string `json:"instance_id"`
-	ImageTag   string `json:"image_tag"`
-	Status     string `json:"status"` // pending, pulling, starting, configuring_proxy, health_checking, success, failed, rolled_back
-	StartedAt  string `json:"started_at"`
-	FinishedAt string `json:"finished_at"`
-	Error      string `json:"error"`
-}
-
-// DeployLog is a single log entry for a deploy.
-type DeployLog struct {
-	ID        int64  `json:"id"`
-	DeployID  string `json:"deploy_id"`
-	Message   string `json:"message"`
-	Level     string `json:"level"` // info, warn, error
-	CreatedAt string `json:"created_at"`
-}
-
-// StageEnv represents a per-stage environment variable override.
-type StageEnv struct {
-	ID        string `json:"id"`
-	StageID   string `json:"stage_id"`
-	Key       string `json:"key"`
-	Value     string `json:"value"`
-	Encrypted bool   `json:"encrypted"`
-	CreatedAt string `json:"created_at"`
-	UpdatedAt string `json:"updated_at"`
-}
-
 // WorkloadVolume is the plugin-shape equivalent of legacy Volume: a
 // per-workload mount declaration. The Scope enum matches the existing
 // VolumeScope contract so the legacy resolver can be reused once its
@@ -256,101 +188,6 @@ func IsValidVolumeScope(s string) bool {
 	return false
 }
 
-// Volume represents a volume mount configuration for a project.
-type Volume struct {
-	ID        string `json:"id"`
-	ProjectID string `json:"project_id"`
-	Source    string `json:"source"`
-	Target   string `json:"target"`
-	Mode     string `json:"mode,omitempty"` // legacy: shared/isolated — kept for DB compat
-	Scope    string `json:"scope"`          // instance, stage, project, project_named, named, ephemeral
-	Name     string `json:"name"`           // required for project_named and named scopes
-	CreatedAt string `json:"created_at"`
-	UpdatedAt string `json:"updated_at"`
-}
-
-// StaticSite represents a static site deployed from a Git repository folder.
-type StaticSite struct {
-	ID             string `json:"id"`
-	Name           string `json:"name"`
-	Provider       string `json:"provider"`         // "gitea", "github", "gitlab"; empty = autodetect
-	GiteaURL       string `json:"gitea_url"`       // base URL, e.g. https://git.example.com
-	RepoOwner      string `json:"repo_owner"`
-	RepoName       string `json:"repo_name"`
-	Branch         string `json:"branch"`
-	FolderPath     string `json:"folder_path"`      // path within repo, e.g. "Pages"
-	AccessToken    string `json:"access_token"`      // encrypted; optional for public repos
-	Domain         string `json:"domain"`            // full domain for proxy
-	Mode           string `json:"mode"`              // "static" or "deno"
-	RenderMarkdown bool   `json:"render_markdown"`
-	SyncTrigger    string `json:"sync_trigger"`      // "push", "tag", "manual"
-	TagPattern     string `json:"tag_pattern"`        // glob pattern for tag-based sync
-	ContainerID    string `json:"container_id"`
-	ProxyRouteID   string `json:"proxy_route_id"`
-	Status         string `json:"status"`            // idle, syncing, deployed, failed
-	LastSyncAt     string `json:"last_sync_at"`
-	LastCommitSHA  string `json:"last_commit_sha"`
-	Error          string `json:"error"`
-	StorageEnabled bool   `json:"storage_enabled"`
-	StorageLimitMB int    `json:"storage_limit_mb"` // 0 = unlimited
-	WebhookSecret      string `json:"-"`                 // per-site webhook secret (URL identifier); never serialized
-	WebhookSigningSecret    string `json:"-"`                       // HMAC-SHA256 key for inbound webhook signature verification; never serialized
-	WebhookRequireSignature bool   `json:"webhook_require_signature"` // if true, reject unsigned/invalid-sig webhook requests
-	NotificationURL    string `json:"notification_url"`   // outgoing webhook target; empty = inherit from settings
-	NotificationSecret string `json:"-"`                 // outgoing-webhook signing secret; never serialized directly
-	CreatedAt      string `json:"created_at"`
-	UpdatedAt      string `json:"updated_at"`
-}
-
-// StaticSiteSecret represents an encrypted environment variable for a static site's Deno backend.
-type StaticSiteSecret struct {
-	ID        string `json:"id"`
-	SiteID    string `json:"site_id"`
-	Key       string `json:"key"`
-	Value     string `json:"value"`
-	Encrypted bool   `json:"encrypted"`
-	CreatedAt string `json:"created_at"`
-	UpdatedAt string `json:"updated_at"`
-}
-
-// Stack represents a docker-compose stack managed as a single deployable unit.
-type Stack struct {
-	ID                 string `json:"id"`
-	Name               string `json:"name"`
-	Description        string `json:"description"`
-	ComposeProjectName string `json:"compose_project_name"` // `-p` arg for docker compose
-	Status             string `json:"status"`               // stopped, deploying, running, failed
-	Error              string `json:"error"`
-	CurrentRevisionID  string `json:"current_revision_id"`
-	CreatedAt          string `json:"created_at"`
-	UpdatedAt          string `json:"updated_at"`
-}
-
-// StackRevision is an append-only record of a YAML version for a stack.
-// Rollback = insert a new revision whose YAML is copied from an older one.
-type StackRevision struct {
-	ID        string `json:"id"`
-	StackID   string `json:"stack_id"`
-	Revision  int    `json:"revision"` // monotonic per stack
-	YAML      string `json:"yaml"`
-	Author    string `json:"author"`
-	DeployID  string `json:"deploy_id"`
-	Status    string `json:"status"` // pending, success, failed
-	CreatedAt string `json:"created_at"`
-}
-
-// StackDeploy records a deployment attempt of a specific revision.
-type StackDeploy struct {
-	ID         string `json:"id"`
-	StackID    string `json:"stack_id"`
-	RevisionID string `json:"revision_id"`
-	Status     string `json:"status"` // pending, deploying, success, failed, rolled_back
-	Log        string `json:"log"`
-	Error      string `json:"error"`
-	StartedAt  string `json:"started_at"`
-	FinishedAt string `json:"finished_at"`
-}
-
 // EventLog represents a persistent event log entry.
 type EventLog struct {
 	ID        int64  `json:"id"`
@@ -437,8 +274,10 @@ const (
 	LogScanSeverityError = "error"
 )
 
-// WorkloadKind enumerates the kinds of things that own containers.
-// Each kind has a corresponding row in projects/stacks/static_sites referenced via Workload.RefID.
+// WorkloadKind enumerates the legacy discriminator values written into
+// containers.workload_kind and workloads.kind. After the hard cutover the
+// backing project / stack / static_site tables are gone — these constants
+// are just strings used to filter the unified containers index in the UI.
 type WorkloadKind string
 
 const (