refactor(workload): plugin architecture wave + apps UI + volume scopes

Completes the workload-first refactor's plugin layer:

- internal/workload/plugin/ — Source/Trigger plugin contract,
  registry, types (Workload, DeploymentIntent, InboundEvent,
  PublicFace). Self-registering init() pattern + blank-import
  in cmd/server/main.go.
- Source plugins: image (blue-green with multi-face proxy routing),
  compose, static. Trigger plugins: registry, git, manual.
- internal/deployer/dispatch.go — DispatchPlugin/Teardown/Reconcile
  seam routing the legacy deployer through plugins.
- internal/api/workload_*.go — REST surface: workloads, env,
  volumes, chain (parent/children), promote-from. hooks.go
  serves /api/hooks/kinds/{kind}/schema for the wizard.
- internal/store: workload_env (encrypt-at-rest secrets) and
  workload_volumes tables, keyed on workload_id.
- cmd/server/static_backend.go — phantom-row adapter delegating
  the static source plugin to the legacy staticsite.Manager
  (deleted at hard cutover once the static inline port lands).
- web/src/routes/apps/ — /apps list + /apps/new wizard +
  /apps/[id] detail with kind-aware compose / image / static
  forms (Advanced JSON toggle), env panel, volumes panel,
  webhook panel, chain panel, manual deploy.

Volume scope generalization (v2 resolver):

- internal/volume.ResolveWorkloadPath (workload-keyed, sits
  next to legacy ResolvePath). Honors all VolumeScope values:
  absolute, ephemeral, instance, stage, project, project_named,
  named. internal/workload/plugin/source/image/image.go
  computeMounts wires settings + imageTag through. Coverage in
  internal/volume/resolver_test.go (portable Linux/Windows via
  t.TempDir).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/deployer/dispatch.go

@@ -0,0 +1,65 @@
+package deployer
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/alexei/tinyforge/internal/workload/plugin"
+)
+
+// DispatchPlugin routes a DeploymentIntent for w to the matching Source
+// plugin. This is the new unified deploy path; the legacy executeDeploy
+// remains in place until Phase 6 ports image-deploy logic into
+// source/image. While both exist, callers must pick: webhook/registry
+// triggers + image deploys still go through the legacy path, while
+// /api/hooks/generic + the unified webhook ingress go through here.
+func (d *Deployer) DispatchPlugin(ctx context.Context, w plugin.Workload, intent plugin.DeploymentIntent) error {
+	src, err := plugin.GetSource(w.SourceKind)
+	if err != nil {
+		return fmt.Errorf("dispatch %s: %w", w.Name, err)
+	}
+	return src.Deploy(ctx, d.PluginDeps(), w, intent)
+}
+
+// DispatchTeardown routes a teardown call to the matching Source plugin.
+// Used when a workload is deleted.
+func (d *Deployer) DispatchTeardown(ctx context.Context, w plugin.Workload) error {
+	src, err := plugin.GetSource(w.SourceKind)
+	if err != nil {
+		return fmt.Errorf("dispatch teardown %s: %w", w.Name, err)
+	}
+	return src.Teardown(ctx, d.PluginDeps(), w)
+}
+
+// DispatchReconcile routes a Reconcile call. Periodic reconciler iterates
+// every Workload and calls this; idle Sources should make it a cheap
+// no-op.
+func (d *Deployer) DispatchReconcile(ctx context.Context, w plugin.Workload) error {
+	src, err := plugin.GetSource(w.SourceKind)
+	if err != nil {
+		return fmt.Errorf("dispatch reconcile %s: %w", w.Name, err)
+	}
+	return src.Reconcile(ctx, d.PluginDeps(), w)
+}
+
+// PluginDeps captures the Deployer's existing dependencies in the bundle
+// shape Sources expect. Reads d.dns under the RWMutex since proxy/DNS
+// can be hot-swapped at runtime when settings change. Exported so the
+// API layer can hand the same Deps to Trigger.Match — passing zero-Deps
+// to triggers would silently nil-panic the moment any Trigger touches
+// deps.Store / deps.Crypto for signature verification.
+func (d *Deployer) PluginDeps() plugin.Deps {
+	d.dnsMu.RLock()
+	dnsProvider := d.dns
+	d.dnsMu.RUnlock()
+	return plugin.Deps{
+		Store:    d.store,
+		Docker:   d.docker,
+		Proxy:    d.proxy,
+		DNS:      dnsProvider,
+		Health:   d.health,
+		Notifier: d.notifier,
+		Events:   d.eventBus,
+		EncKey:   d.encKey,
+	}
+}