refactor(workload): plugin architecture wave + apps UI + volume scopes

Completes the workload-first refactor's plugin layer:

- internal/workload/plugin/ — Source/Trigger plugin contract,
  registry, types (Workload, DeploymentIntent, InboundEvent,
  PublicFace). Self-registering init() pattern + blank-import
  in cmd/server/main.go.
- Source plugins: image (blue-green with multi-face proxy routing),
  compose, static. Trigger plugins: registry, git, manual.
- internal/deployer/dispatch.go — DispatchPlugin/Teardown/Reconcile
  seam routing the legacy deployer through plugins.
- internal/api/workload_*.go — REST surface: workloads, env,
  volumes, chain (parent/children), promote-from. hooks.go
  serves /api/hooks/kinds/{kind}/schema for the wizard.
- internal/store: workload_env (encrypt-at-rest secrets) and
  workload_volumes tables, keyed on workload_id.
- cmd/server/static_backend.go — phantom-row adapter delegating
  the static source plugin to the legacy staticsite.Manager
  (deleted at hard cutover once the static inline port lands).
- web/src/routes/apps/ — /apps list + /apps/new wizard +
  /apps/[id] detail with kind-aware compose / image / static
  forms (Advanced JSON toggle), env panel, volumes panel,
  webhook panel, chain panel, manual deploy.

Volume scope generalization (v2 resolver):

- internal/volume.ResolveWorkloadPath (workload-keyed, sits
  next to legacy ResolvePath). Honors all VolumeScope values:
  absolute, ephemeral, instance, stage, project, project_named,
  named. internal/workload/plugin/source/image/image.go
  computeMounts wires settings + imageTag through. Coverage in
  internal/volume/resolver_test.go (portable Linux/Windows via
  t.TempDir).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/workload/plugin/trigger/registry/registry_test.go

@@ -0,0 +1,155 @@
+package registry
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+
+	"github.com/alexei/tinyforge/internal/workload/plugin"
+)
+
+func mustConfig(t *testing.T, c Config) json.RawMessage {
+	t.Helper()
+	b, err := json.Marshal(c)
+	if err != nil {
+		t.Fatalf("marshal config: %v", err)
+	}
+	return b
+}
+
+func TestValidate(t *testing.T) {
+	tr := &trigger{}
+	cases := []struct {
+		name    string
+		cfg     json.RawMessage
+		wantErr bool
+	}{
+		{"empty body rejected", nil, true},
+		{"missing image rejected", mustConfig(t, Config{TagPattern: "*"}), true},
+		{"valid wildcard", mustConfig(t, Config{Image: "owner/app", TagPattern: "*"}), false},
+		{"valid with glob", mustConfig(t, Config{Image: "registry.example.com/owner/app", TagPattern: "v*"}), false},
+		{"invalid glob", mustConfig(t, Config{Image: "owner/app", TagPattern: "v[oops"}), true},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			err := tr.Validate(tc.cfg)
+			if (err != nil) != tc.wantErr {
+				t.Fatalf("Validate(%s) err=%v want err=%v", tc.name, err, tc.wantErr)
+			}
+		})
+	}
+}
+
+func TestImageMatches(t *testing.T) {
+	cases := []struct {
+		name        string
+		want, got   string
+		shouldMatch bool
+	}{
+		{"exact qualified", "registry.example.com/owner/app", "registry.example.com/owner/app", true},
+		{"host case-insensitive", "REGISTRY.example.com/owner/app", "registry.example.com/owner/app", true},
+		{"path mismatch", "registry.example.com/owner/app", "registry.example.com/owner/other", false},
+		{"different registry", "a.example.com/owner/app", "b.example.com/owner/app", false},
+		// Single-segment images (Docker Hub officials) — recently fixed.
+		{"both single-segment equal", "nginx", "nginx", true},
+		{"both single-segment unequal", "nginx", "postgres", false},
+		{"want single, got qualified", "nginx", "library/nginx", false},
+		{"want qualified, got single", "library/nginx", "nginx", false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := imageMatches(tc.want, tc.got); got != tc.shouldMatch {
+				t.Errorf("imageMatches(%q, %q) = %v, want %v", tc.want, tc.got, got, tc.shouldMatch)
+			}
+		})
+	}
+}
+
+func TestMatch(t *testing.T) {
+	tr := &trigger{}
+	cfg := mustConfig(t, Config{Image: "registry.example.com/owner/app", TagPattern: "v*"})
+	wl := plugin.Workload{
+		ID:            "wkl-1",
+		TriggerConfig: cfg,
+	}
+
+	t.Run("wrong event kind returns nil", func(t *testing.T) {
+		evt := plugin.InboundEvent{Kind: "git-push"}
+		intent, err := tr.Match(context.Background(), plugin.Deps{}, wl, evt)
+		if err != nil || intent != nil {
+			t.Fatalf("expected nil intent, got intent=%v err=%v", intent, err)
+		}
+	})
+
+	t.Run("matching push produces intent", func(t *testing.T) {
+		evt := plugin.InboundEvent{
+			Kind: "image-push",
+			Image: &plugin.ImagePushEvent{
+				Registry: "registry.example.com",
+				Repo:     "owner/app",
+				Tag:      "v1.2.3",
+			},
+		}
+		intent, err := tr.Match(context.Background(), plugin.Deps{}, wl, evt)
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if intent == nil {
+			t.Fatal("expected non-nil intent")
+		}
+		if intent.Reference != "v1.2.3" {
+			t.Errorf("intent.Reference = %q, want v1.2.3", intent.Reference)
+		}
+		if intent.Reason != "registry-push" {
+			t.Errorf("intent.Reason = %q, want registry-push", intent.Reason)
+		}
+	})
+
+	t.Run("tag outside glob returns nil", func(t *testing.T) {
+		evt := plugin.InboundEvent{
+			Kind: "image-push",
+			Image: &plugin.ImagePushEvent{
+				Registry: "registry.example.com",
+				Repo:     "owner/app",
+				Tag:      "latest", // doesn't match v*
+			},
+		}
+		intent, err := tr.Match(context.Background(), plugin.Deps{}, wl, evt)
+		if err != nil || intent != nil {
+			t.Fatalf("expected nil intent for tag=latest, got intent=%v err=%v", intent, err)
+		}
+	})
+
+	t.Run("wrong repo returns nil", func(t *testing.T) {
+		evt := plugin.InboundEvent{
+			Kind: "image-push",
+			Image: &plugin.ImagePushEvent{
+				Registry: "registry.example.com",
+				Repo:     "owner/other",
+				Tag:      "v1.0.0",
+			},
+		}
+		intent, err := tr.Match(context.Background(), plugin.Deps{}, wl, evt)
+		if err != nil || intent != nil {
+			t.Fatalf("expected nil intent for wrong repo, got intent=%v err=%v", intent, err)
+		}
+	})
+
+	t.Run("empty pattern matches anything", func(t *testing.T) {
+		wlAny := plugin.Workload{
+			ID:            "wkl-any",
+			TriggerConfig: mustConfig(t, Config{Image: "owner/app"}),
+		}
+		evt := plugin.InboundEvent{
+			Kind: "image-push",
+			Image: &plugin.ImagePushEvent{Repo: "owner/app", Tag: "latest"},
+		}
+		intent, err := tr.Match(context.Background(), plugin.Deps{}, wlAny, evt)
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if intent == nil {
+			t.Fatal("expected match with empty pattern")
+		}
+	})
+}