feat(apps): per-app deploy/activity timeline

Every deploy across all four source kinds now writes a workload-scoped
event via a shared plugin.EmitDeployEvent helper (replacing the inline
emit duplicated in static/dockerfile, standardizing static's metadata
key site_id->workload_id, and adding emission to image+compose which
were silent). New indexed event_log.workload_id column, EventLogFilter
.WorkloadID, and GET /api/workloads/{id}/events (id pinned from path).

Frontend: a forge "Activity" panel on /apps/[id] reusing EventLogEntry,
live SSE prepend filtered by workload_id, load-more pagination, an
All/Errors severity filter, and a shared toEventLogEntry mapper. en/ru
i18n parity.

Security: compose's failure status emits a generic reason instead of raw
`docker compose up` output, which can echo app secrets and egresses to
operator webhooks (NotificationURL + event-trigger actions); full detail
stays only in the returned error. Rune-safe 256-rune status cap.

Reviewed: go + typescript APPROVE; security HIGH fixed.

web/src/lib/i18n/en.json

@@ -545,6 +545,9 @@
     },
     "source": {
       "deploy": "Deploy",
+      "image": "Image",
+      "compose": "Compose",
+      "dockerfile": "Dockerfile",
       "static_site": "Static Site",
       "stale_scanner": "Stale Scanner",
       "stale_cleanup": "Stale Cleanup",
@@ -1406,6 +1409,16 @@
       "deployError": "Deploy failed",
       "saveError": "Save failed",
       "deleteError": "Delete failed",
+      "activity": {
+        "title": "Activity",
+        "subtitle": "Recent deploys and events for this app",
+        "empty": "No activity yet. Deploys and events will appear here.",
+        "recentNote": "Showing recent activity.",
+        "loadMore": "Load more",
+        "filterAll": "All",
+        "filterErrors": "Errors",
+        "noErrors": "No errors in the loaded activity."
+      },
       "runtimeState": {
         "title": "Sync status",
         "sub": "Last successful sync of the source repo and the current container state.",