refactor(workload): plugin architecture wave + apps UI + volume scopes

Completes the workload-first refactor's plugin layer:

- internal/workload/plugin/ — Source/Trigger plugin contract,
  registry, types (Workload, DeploymentIntent, InboundEvent,
  PublicFace). Self-registering init() pattern + blank-import
  in cmd/server/main.go.
- Source plugins: image (blue-green with multi-face proxy routing),
  compose, static. Trigger plugins: registry, git, manual.
- internal/deployer/dispatch.go — DispatchPlugin/Teardown/Reconcile
  seam routing the legacy deployer through plugins.
- internal/api/workload_*.go — REST surface: workloads, env,
  volumes, chain (parent/children), promote-from. hooks.go
  serves /api/hooks/kinds/{kind}/schema for the wizard.
- internal/store: workload_env (encrypt-at-rest secrets) and
  workload_volumes tables, keyed on workload_id.
- cmd/server/static_backend.go — phantom-row adapter delegating
  the static source plugin to the legacy staticsite.Manager
  (deleted at hard cutover once the static inline port lands).
- web/src/routes/apps/ — /apps list + /apps/new wizard +
  /apps/[id] detail with kind-aware compose / image / static
  forms (Advanced JSON toggle), env panel, volumes panel,
  webhook panel, chain panel, manual deploy.

Volume scope generalization (v2 resolver):

- internal/volume.ResolveWorkloadPath (workload-keyed, sits
  next to legacy ResolvePath). Honors all VolumeScope values:
  absolute, ephemeral, instance, stage, project, project_named,
  named. internal/workload/plugin/source/image/image.go
  computeMounts wires settings + imageTag through. Coverage in
  internal/volume/resolver_test.go (portable Linux/Windows via
  t.TempDir).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/workload/plugin/trigger/manual/manual.go

@@ -0,0 +1,57 @@
+// Package manual implements the "manual" trigger: any ManualEvent fires a
+// deploy. No per-workload config — the trigger always matches its kind.
+package manual
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"time"
+
+	"github.com/alexei/tinyforge/internal/workload/plugin"
+)
+
+type trigger struct{}
+
+func init() { plugin.RegisterTrigger(&trigger{}) }
+
+func (*trigger) Kind() string { return "manual" }
+
+func (*trigger) SchemaSample() any { return struct{}{} }
+
+func (*trigger) Validate(cfg json.RawMessage) error {
+	// Manual triggers have no config; accept empty or a small valid JSON
+	// blob. The cap prevents an admin from pinning a 1 MiB blob to a
+	// trigger row that gets serialized on every read.
+	if len(cfg) == 0 {
+		return nil
+	}
+	if len(cfg) > 1024 {
+		return fmt.Errorf("manual trigger: config must be empty or a small JSON value (got %d bytes)", len(cfg))
+	}
+	if !json.Valid(cfg) {
+		return fmt.Errorf("manual trigger: invalid json")
+	}
+	return nil
+}
+
+func (*trigger) Match(ctx context.Context, deps plugin.Deps, w plugin.Workload, evt plugin.InboundEvent) (*plugin.DeploymentIntent, error) {
+	if evt.Kind != "manual" || evt.Manual == nil {
+		return nil, nil
+	}
+	actor := evt.Manual.Actor
+	if actor == "" {
+		actor = "manual"
+	}
+	meta := map[string]string{}
+	if evt.Manual.Note != "" {
+		meta["note"] = evt.Manual.Note
+	}
+	return &plugin.DeploymentIntent{
+		Reason:      "manual",
+		Reference:   evt.Manual.Reference,
+		Metadata:    meta,
+		TriggeredAt: time.Now().UTC(),
+		TriggeredBy: actor,
+	}, nil
+}

internal/workload/plugin/trigger/manual/manual_test.go

@@ -0,0 +1,83 @@
+package manual
+
+import (
+	"context"
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"github.com/alexei/tinyforge/internal/workload/plugin"
+)
+
+func TestValidate(t *testing.T) {
+	tr := &trigger{}
+	cases := []struct {
+		name    string
+		cfg     json.RawMessage
+		wantErr bool
+	}{
+		{"empty body accepted", nil, false},
+		{"empty object accepted", json.RawMessage(`{}`), false},
+		{"valid small object accepted", json.RawMessage(`{"note":"hello"}`), false},
+		{"invalid json rejected", json.RawMessage(`not json`), true},
+		{"oversize rejected", json.RawMessage(`{"big":"` + strings.Repeat("x", 1100) + `"}`), true},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			err := tr.Validate(tc.cfg)
+			if (err != nil) != tc.wantErr {
+				t.Fatalf("Validate(%s) err=%v want err=%v", tc.name, err, tc.wantErr)
+			}
+		})
+	}
+}
+
+func TestMatch(t *testing.T) {
+	tr := &trigger{}
+	wl := plugin.Workload{ID: "wkl-1"}
+
+	t.Run("wrong kind ignored", func(t *testing.T) {
+		evt := plugin.InboundEvent{Kind: "image-push"}
+		intent, err := tr.Match(context.Background(), plugin.Deps{}, wl, evt)
+		if err != nil || intent != nil {
+			t.Fatalf("expected nil intent, got intent=%v err=%v", intent, err)
+		}
+	})
+
+	t.Run("manual fires with actor + note", func(t *testing.T) {
+		evt := plugin.InboundEvent{
+			Kind:   "manual",
+			Manual: &plugin.ManualEvent{Actor: "alice", Reference: "v1.0.0", Note: "rollback"},
+		}
+		intent, err := tr.Match(context.Background(), plugin.Deps{}, wl, evt)
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if intent == nil {
+			t.Fatal("expected non-nil intent")
+		}
+		if intent.TriggeredBy != "alice" {
+			t.Errorf("TriggeredBy = %q, want alice", intent.TriggeredBy)
+		}
+		if intent.Reference != "v1.0.0" {
+			t.Errorf("Reference = %q, want v1.0.0", intent.Reference)
+		}
+		if intent.Metadata["note"] != "rollback" {
+			t.Errorf("note metadata = %q, want rollback", intent.Metadata["note"])
+		}
+	})
+
+	t.Run("missing actor falls back", func(t *testing.T) {
+		evt := plugin.InboundEvent{
+			Kind:   "manual",
+			Manual: &plugin.ManualEvent{Reference: "v2"},
+		}
+		intent, err := tr.Match(context.Background(), plugin.Deps{}, wl, evt)
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if intent.TriggeredBy != "manual" {
+			t.Errorf("TriggeredBy = %q, want manual", intent.TriggeredBy)
+		}
+	})
+}