feat(cutover): hard legacy cutover — drop projects/stacks/sites/deploys

The clean-break delete that closes the workload-first refactor arc.
Net diff: ~30 backend files deleted, ~20 modified, ~12k LOC removed
on the Go side; entire /projects /stacks /sites /deploy frontend
trees gone; ~6.7k LOC removed on the Svelte/TypeScript side.

Backend
- API handlers gone: internal/api/{projects,stages,stage_env,stacks,
  static_sites,deploys,instances,volume_browser}.go
- Store CRUD + tests gone: internal/store/{projects,stages,stage_env,
  stacks,static_sites,static_site_secrets,deploys,poll_state,volumes,
  workload_sync}.go (+ _test.go siblings)
- Legacy deployer pipeline gone: internal/deployer/{bluegreen,promote,
  rollback,subdomain,resolver_test}.go; deployer.go trimmed to just the
  dispatch surface used by the plugin pipeline
- internal/staticsite/{manager,healthcheck}.go and
  internal/stack/manager.go gone (the rest of those packages stay as
  helpers imported by the static + compose plugins)
- internal/registry/poller.go gone (legacy registry poller)
- internal/volume.ResolvePath gone; ResolveWorkloadPath stays
- internal/webhook: handleWebhook (project) + handleSiteWebhook (site)
  gone; only POST /api/webhook/triggers/{secret} remains
- workload-side webhook URL handlers (getWorkloadWebhook +
  regenerateWorkloadWebhook + EnsureWorkloadWebhookSecret +
  SetWorkloadWebhookSecret + GetWorkloadByWebhookSecret) gone — they
  minted URLs that would 404 against the new trigger-only ingress
- cmd/server/main.go: dropped staticsite.Manager, stack.Manager,
  staticsite.HealthChecker, registry poller, SetSiteSyncTriggerer,
  SetStaticSiteManager, SetStackManager, wireStaticBackend
- store/store.go: idempotent DROP TABLE IF EXISTS for every legacy
  table (projects, stages, stage_env, volumes, deploys, deploy_logs,
  poll_states, stacks, stack_revisions, stack_deploys, static_sites,
  static_site_secrets); FK order children-then-parents
- store/models.go: dropped Project, Stage, Deploy, DeployLog, StageEnv,
  Volume, StaticSite, StaticSiteSecret, Stack, StackRevision,
  StackDeploy types; kept WorkloadKind constants as documented strings
- internal/store/helpers.go (new): BoolToInt, rowScanner,
  GenerateWebhookSecret extracted from deleted CRUD files
- internal/api/secrets.go (new): forwards to store.GenerateWebhookSecret
  so api + store paths share one secret-generation impl (no
  panic-vs-UUID-fallback divergence)
- internal/reconciler/reconciler.go: dropped legacy stack-by-compose
  + static-site label paths; only canonical tinyforge.workload.id
  dispatch remains
- providers (gitea_content/github_provider/gitlab_provider) gained
  path-traversal rejection on every tree entry
- internal/webhook ParsedImage / ParseImageRef demoted to package-
  private (no external callers)

Frontend
- /projects /stacks /sites /deploy routes deleted (entire trees)
- ProjectCard / InstanceCard / StaleContainerCard components deleted
- api.ts: dropped every project/stage/stack/site/deploy/instance
  helper + types (Project, Stage, Stack, StaticSite, Deploy,
  Instance, Volume, etc.); kept Workload, Container, App, Settings,
  Registry, EventTrigger, LogScanRule, webhook envelopes
- WorkloadWebhook type + getWorkloadWebhook/regenerateWorkloadWebhook
  api functions gone (mirror of the backend deletion above)
- web/src/routes/+layout.svelte: dropped /projects /sites /stacks
  /deploy nav entries, trimmed quick-nav keymap
- web/src/routes/+page.svelte: dashboard rewrite — reads
  listWorkloads + listContainers only; 4-card stat grid
  (workloads/running/failed/stale) + recent workloads strip
- navCounts.ts, SystemHealthCard.svelte, ContainerLogs.svelte,
  ContainerStats.svelte, StatusBadge.svelte, TagCombobox.svelte,
  proxies/+page.svelte, containers/+page.svelte all rewired to the
  workload-first surface
- AbortController plumbing on dashboard, nav-counts, stale page,
  SystemHealthCard so navigation doesn't leave dangling fetches
- i18n: dropped projects.*, projectDetail.*, envEditor.*,
  volumeEditor.*, volumeBrowser.*, quickDeploy.*, sites.*, stacks.*,
  instance.*, confirm.* namespaces; en/ru parity preserved (1042
  keys each)

Hardening from go-reviewer + security-reviewer + typescript-reviewer
subagent passes (0 CRITICAL across all three; 1 HIGH + ~12 MEDIUM
addressed inline before commit):

- Sec H1: dead-end workload webhook URL handlers (would mint URLs
  that 404 the new trigger-only ingress) deleted across backend +
  frontend
- Go M1: IsTerminalDeployStatus dropped (no production callers)
- Go M2: ParsedImage/ParseImageRef lowercased (in-package only)
- Go M6: generateWebhookSecret unified — api shim forwards to
  store.GenerateWebhookSecret
- Doc/comment freshness: stage_id (no longer FK), ProxyRoute legacy
  field names, workloadIDRow rationale, webhook_deliveries.target_type
  enum, WebhookDeliveryLog component header

Doc
- WORKLOAD_REFACTOR_TODO: cutover marked DONE; all three Priority 1
  items are now shipped. Next focus is Priority 3 polish (apps.* i18n
  + codemap entries) and Priority 4 tests.

Behavioral notes for operators upgrading from a pre-cutover build
- Existing rows in the dropped tables disappear on first boot.
- Legacy webhook URLs at /api/webhook/{secret} and
  /api/webhook/sites/{secret} return 404; CI configs must repoint to
  /api/webhook/triggers/{secret} (the trigger-split boot backfill
  lifted any embedded workload secret onto a Trigger row, so the
  secret value itself carries over).
- Frontend routes /projects /stacks /sites /deploy are gone; nav
  links replaced with /apps and /triggers.

internal/store/store_test.go

@@ -14,62 +14,6 @@ func newTestStore(t *testing.T) *Store {
 	return s
 }
 
-func TestCreateAndGetProject(t *testing.T) {
-	s := newTestStore(t)
-
-	p, err := s.CreateProject(Project{
-		Name: "test-project", Image: "nginx", Port: 80, Env: "{}", Volumes: "{}",
-	})
-	if err != nil {
-		t.Fatalf("CreateProject: %v", err)
-	}
-	if p.ID == "" {
-		t.Fatal("project ID should be set")
-	}
-
-	got, err := s.GetProjectByID(p.ID)
-	if err != nil {
-		t.Fatalf("GetProjectByID: %v", err)
-	}
-	if got.Name != "test-project" {
-		t.Fatalf("got name %q, want %q", got.Name, "test-project")
-	}
-}
-
-func TestGetAllProjects(t *testing.T) {
-	s := newTestStore(t)
-
-	s.CreateProject(Project{Name: "bravo", Image: "img", Env: "{}", Volumes: "{}"})
-	s.CreateProject(Project{Name: "alpha", Image: "img", Env: "{}", Volumes: "{}"})
-
-	projects, err := s.GetAllProjects()
-	if err != nil {
-		t.Fatalf("GetAllProjects: %v", err)
-	}
-	if len(projects) != 2 {
-		t.Fatalf("expected 2 projects, got %d", len(projects))
-	}
-	// Should be ordered by name
-	if projects[0].Name != "alpha" {
-		t.Fatalf("expected first project 'alpha', got %q", projects[0].Name)
-	}
-}
-
-func TestDeleteProject(t *testing.T) {
-	s := newTestStore(t)
-
-	p, _ := s.CreateProject(Project{Name: "del-me", Image: "img", Env: "{}", Volumes: "{}"})
-	err := s.DeleteProject(p.ID)
-	if err != nil {
-		t.Fatalf("DeleteProject: %v", err)
-	}
-
-	_, err = s.GetProjectByID(p.ID)
-	if err == nil {
-		t.Fatal("expected error getting deleted project")
-	}
-}
-
 func TestCreateAndGetUser(t *testing.T) {
 	s := newTestStore(t)
 
@@ -110,80 +54,6 @@ func TestUserCount(t *testing.T) {
 	}
 }
 
-func TestCreateStageAndDeploy(t *testing.T) {
-	s := newTestStore(t)
-
-	p, _ := s.CreateProject(Project{Name: "proj", Image: "img", Env: "{}", Volumes: "{}"})
-	stage, err := s.CreateStage(Stage{
-		ProjectID: p.ID, Name: "dev", TagPattern: "*", MaxInstances: 2,
-	})
-	if err != nil {
-		t.Fatalf("CreateStage: %v", err)
-	}
-
-	d, err := s.CreateDeploy(Deploy{
-		ProjectID: p.ID, StageID: stage.ID, ImageTag: "v1.0",
-	})
-	if err != nil {
-		t.Fatalf("CreateDeploy: %v", err)
-	}
-	if d.Status != "pending" {
-		t.Fatalf("expected pending status, got %q", d.Status)
-	}
-
-	err = s.UpdateDeployStatus(d.ID, "success", "")
-	if err != nil {
-		t.Fatalf("UpdateDeployStatus: %v", err)
-	}
-
-	got, _ := s.GetDeployByID(d.ID)
-	if got.Status != "success" {
-		t.Fatalf("expected success, got %q", got.Status)
-	}
-}
-
-func TestGetDeploysByProjectID(t *testing.T) {
-	s := newTestStore(t)
-
-	p, _ := s.CreateProject(Project{Name: "proj", Image: "img", Env: "{}", Volumes: "{}"})
-	stage, _ := s.CreateStage(Stage{ProjectID: p.ID, Name: "dev", TagPattern: "*"})
-
-	for i := 0; i < 5; i++ {
-		_, err := s.CreateDeploy(Deploy{ProjectID: p.ID, StageID: stage.ID, ImageTag: "v" + string(rune('0'+i))})
-		if err != nil {
-			t.Fatalf("CreateDeploy %d: %v", i, err)
-		}
-	}
-
-	deploys, err := s.GetDeploysByProjectID(p.ID)
-	if err != nil {
-		t.Fatalf("GetDeploysByProjectID: %v", err)
-	}
-	if len(deploys) != 5 {
-		t.Fatalf("expected 5 deploys, got %d", len(deploys))
-	}
-}
-
-func TestGetRecentDeploys(t *testing.T) {
-	s := newTestStore(t)
-
-	p, _ := s.CreateProject(Project{Name: "proj", Image: "img", Env: "{}", Volumes: "{}"})
-	stage, _ := s.CreateStage(Stage{ProjectID: p.ID, Name: "dev", TagPattern: "*"})
-
-	for i := 0; i < 5; i++ {
-		s.CreateDeploy(Deploy{ProjectID: p.ID, StageID: stage.ID, ImageTag: "v" + string(rune('0'+i))})
-	}
-
-	// Limit to 2
-	deploys, err := s.GetRecentDeploys(2)
-	if err != nil {
-		t.Fatalf("GetRecentDeploys: %v", err)
-	}
-	if len(deploys) != 2 {
-		t.Fatalf("expected 2 deploys with limit, got %d", len(deploys))
-	}
-}
-
 func TestDeleteUser(t *testing.T) {
 	s := newTestStore(t)
 
@@ -199,27 +69,6 @@ func TestDeleteUser(t *testing.T) {
 	}
 }
 
-func TestUpdateProject(t *testing.T) {
-	s := newTestStore(t)
-
-	p, _ := s.CreateProject(Project{Name: "original", Image: "nginx", Env: "{}", Volumes: "{}"})
-
-	p.Name = "updated"
-	p.Image = "alpine"
-	err := s.UpdateProject(p)
-	if err != nil {
-		t.Fatalf("UpdateProject: %v", err)
-	}
-
-	got, _ := s.GetProjectByID(p.ID)
-	if got.Name != "updated" {
-		t.Fatalf("expected name 'updated', got %q", got.Name)
-	}
-	if got.Image != "alpine" {
-		t.Fatalf("expected image 'alpine', got %q", got.Image)
-	}
-}
-
 func TestUpdateUser(t *testing.T) {
 	s := newTestStore(t)
 
@@ -241,88 +90,3 @@ func TestUpdateUser(t *testing.T) {
 	}
 }
 
-func TestDeployLogs(t *testing.T) {
-	s := newTestStore(t)
-
-	p, _ := s.CreateProject(Project{Name: "proj", Image: "img", Env: "{}", Volumes: "{}"})
-	stage, _ := s.CreateStage(Stage{ProjectID: p.ID, Name: "dev", TagPattern: "*"})
-	d, _ := s.CreateDeploy(Deploy{ProjectID: p.ID, StageID: stage.ID, ImageTag: "v1"})
-
-	err := s.AppendDeployLog(d.ID, "pulling image", "info")
-	if err != nil {
-		t.Fatalf("AppendDeployLog: %v", err)
-	}
-	err = s.AppendDeployLog(d.ID, "something failed", "error")
-	if err != nil {
-		t.Fatalf("AppendDeployLog: %v", err)
-	}
-
-	logs, err := s.GetDeployLogs(d.ID)
-	if err != nil {
-		t.Fatalf("GetDeployLogs: %v", err)
-	}
-	if len(logs) != 2 {
-		t.Fatalf("expected 2 logs, got %d", len(logs))
-	}
-	if logs[0].Message != "pulling image" {
-		t.Fatalf("expected first log 'pulling image', got %q", logs[0].Message)
-	}
-	if logs[1].Level != "error" {
-		t.Fatalf("expected second log level 'error', got %q", logs[1].Level)
-	}
-}
-
-func TestGetStagesByProjectID(t *testing.T) {
-	s := newTestStore(t)
-
-	p, _ := s.CreateProject(Project{Name: "proj", Image: "img", Env: "{}", Volumes: "{}"})
-	s.CreateStage(Stage{ProjectID: p.ID, Name: "prod", TagPattern: "v*"})
-	s.CreateStage(Stage{ProjectID: p.ID, Name: "dev", TagPattern: "*"})
-
-	stages, err := s.GetStagesByProjectID(p.ID)
-	if err != nil {
-		t.Fatalf("GetStagesByProjectID: %v", err)
-	}
-	if len(stages) != 2 {
-		t.Fatalf("expected 2 stages, got %d", len(stages))
-	}
-	// Ordered by name
-	if stages[0].Name != "dev" {
-		t.Fatalf("expected first stage 'dev', got %q", stages[0].Name)
-	}
-}
-
-func TestIsTerminalDeployStatus(t *testing.T) {
-	terminals := []string{"success", "failed", "rolled_back"}
-	for _, s := range terminals {
-		if !IsTerminalDeployStatus(s) {
-			t.Fatalf("expected %q to be terminal", s)
-		}
-	}
-
-	nonTerminals := []string{"pending", "pulling", "starting", "configuring_proxy", "health_checking"}
-	for _, s := range nonTerminals {
-		if IsTerminalDeployStatus(s) {
-			t.Fatalf("expected %q to be non-terminal", s)
-		}
-	}
-}
-
-func TestCascadeDeleteProjectRemovesStagesAndDeploys(t *testing.T) {
-	s := newTestStore(t)
-
-	p, _ := s.CreateProject(Project{Name: "proj", Image: "img", Env: "{}", Volumes: "{}"})
-	stage, _ := s.CreateStage(Stage{ProjectID: p.ID, Name: "dev", TagPattern: "*"})
-	s.CreateDeploy(Deploy{ProjectID: p.ID, StageID: stage.ID, ImageTag: "v1"})
-
-	err := s.DeleteProject(p.ID)
-	if err != nil {
-		t.Fatalf("DeleteProject: %v", err)
-	}
-
-	// Stage should be gone
-	_, err = s.GetStageByID(stage.ID)
-	if err == nil {
-		t.Fatal("expected stage to be deleted by cascade")
-	}
-}