feat(apps): per-app deploy/activity timeline

Every deploy across all four source kinds now writes a workload-scoped
event via a shared plugin.EmitDeployEvent helper (replacing the inline
emit duplicated in static/dockerfile, standardizing static's metadata
key site_id->workload_id, and adding emission to image+compose which
were silent). New indexed event_log.workload_id column, EventLogFilter
.WorkloadID, and GET /api/workloads/{id}/events (id pinned from path).

Frontend: a forge "Activity" panel on /apps/[id] reusing EventLogEntry,
live SSE prepend filtered by workload_id, load-more pagination, an
All/Errors severity filter, and a shared toEventLogEntry mapper. en/ru
i18n parity.

Security: compose's failure status emits a generic reason instead of raw
`docker compose up` output, which can echo app secrets and egresses to
operator webhooks (NotificationURL + event-trigger actions); full detail
stays only in the returned error. Rune-safe 256-rune status cap.

Reviewed: go + typescript APPROVE; security HIGH fixed.

internal/workload/plugin/source/dockerfile/deploy.go

@@ -2,7 +2,6 @@ package dockerfile
 
 import (
 	"context"
-	"encoding/json"
 	"fmt"
 	"io"
 	"log/slog"
@@ -506,49 +505,13 @@ func dispatchBuildNotification(deps plugin.Deps, w plugin.Workload, domain, stat
 	})
 }
 
-// publishEvent emits a status event on the bus AND persists an
-// event_log row. Message shape mirrors the static plugin
-// ("Build %q: %s") so the dashboard's audit feed reads consistently
-// across both kinds.
+// publishEvent records a workload-scoped deploy event in the audit log.
+// The InsertEvent + bus publish (and consistent message/metadata shape
+// across source kinds) is centralised in plugin.EmitDeployEvent so the
+// dashboard's audit feed and the per-workload timeline read identically
+// for image / compose / static / dockerfile deploys.
 func publishEvent(deps plugin.Deps, w plugin.Workload, status string) {
-	severity := "info"
-	if strings.HasPrefix(status, "failed") {
-		severity = "error"
-	}
-	message := fmt.Sprintf("Build %q: %s", w.Name, status)
-
-	metaBytes, err := json.Marshal(map[string]string{
-		"workload_id":   w.ID,
-		"workload_name": w.Name,
-		"status":        status,
-	})
-	if err != nil {
-		slog.Error("dockerfile: marshal event metadata", "error", err)
-		metaBytes = []byte("{}")
-	}
-	metadata := string(metaBytes)
-
-	evt, err := deps.Store.InsertEvent(store.EventLog{
-		Source:   "dockerfile",
-		Severity: severity,
-		Message:  message,
-		Metadata: metadata,
-	})
-	if err != nil {
-		slog.Error("dockerfile: failed to persist event log", "error", err)
-		return
-	}
-	deps.Events.Publish(events.Event{
-		Type: events.EventLog,
-		Payload: events.EventLogPayload{
-			ID:        evt.ID,
-			Source:    "dockerfile",
-			Severity:  severity,
-			Message:   message,
-			Metadata:  metadata,
-			CreatedAt: evt.CreatedAt,
-		},
-	})
+	plugin.EmitDeployEvent(deps, w, "dockerfile", status)
 }
 
 // publishBuildLog emits one EventBuildLog per non-empty daemon "stream"