fix: harden security, fix concurrency bugs, and address review findings

Security:
- rate limit /api/webhook routes per-IP and cap concurrent site syncs
- global SSE connection cap (256) with new sse_gate
- validate ?tail= and cap JSON log responses at 4 MiB
- strip ANSI/CSI/OSC and control bytes from streamed log lines
- redact webhook secret from request log middleware
- scrub host details from /api/health for non-admin viewers
- drop container_id from /api/system/stats/top for non-admins
- generate webhook secrets via crypto/rand; require >=32 chars on insert
- verify iid path consistency in streamContainerLogs
- LimitReader on site webhook body; reject malformed non-empty bodies

Concurrency / correctness:
- stats collector: Stop() no longer hangs without Start(), semaphore
  acquired in parent loop so ctx cancellation short-circuits the queue,
  in-flight tick cancellable via shared base context, zero-ts guard
- webhook handler: replace fire-and-forget goroutine with WaitGroup-tracked
  workers + Drain() wired into graceful shutdown
- $derived(() => ...) mis-idiom fixed in ContainerStats / InstanceCard /
  ProjectCard (returned function instead of value)
- SystemResourcesCard: rename `window` and `t` locals to avoid shadowing
  globalThis.window and the i18n `t` import

Quality / performance:
- replace O(n^2) insertion sort with sort.Slice in stats top
- runMigrations only swallows duplicate-column / already-exists errors
- PruneStatsSamplesBefore wrapped in a transaction
- collapse N+1 in unusedImageStats / pruneImages to one ListAllInstances
  pass; surface DB errors instead of silently treating them as inactive
- run Docker Info + DiskUsage in parallel via errgroup
- container log SSE emits `: ping` heartbeat every 20 s
- imageMatches case-insensitive on registry host (RFC behaviour)
- log warning on invalid stage tag pattern instead of silent skip
- reject malformed non-empty site webhook payloads

Frontend / i18n:
- shared formatBytes utility replaces three local copies
- statsInterval store drives dynamic "no samples / collection disabled"
  copy across ContainerStats and SystemResourcesCard
- top consumers row now shows owner_name (project/stage or site name)
- drop seven `as any` casts on the Settings type; add cloudflare_api_token
  write-only field
- move "Service status", "Docker daemon", "Docker unreachable",
  "Proxy unreachable", "reachable", and "Docker daemon is not reachable."
  strings into en/ru i18n bundles

internal/webhook/matcher.go

@@ -2,6 +2,7 @@ package webhook
 
 import (
 	"fmt"
+	"log/slog"
 	"path"
 	"strings"
 
@@ -24,7 +25,8 @@ func matchStage(st *store.Store, projectID, tag string) (store.Stage, bool, erro
 
 		matched, err := path.Match(pattern, tag)
 		if err != nil {
-			// Invalid pattern — skip this stage.
+			slog.Warn("webhook: invalid tag pattern, skipping stage",
+				"project", projectID, "stage", stage.Name, "pattern", pattern, "error", err)
 			continue
 		}
 		if matched {
@@ -36,9 +38,21 @@ func matchStage(st *store.Store, projectID, tag string) (store.Stage, bool, erro
 }
 
 // imageMatches reports whether an incoming image reference matches the
-// project's stored image. The comparison is case-sensitive and exact.
+// project's stored image. The registry hostname is matched case-insensitively
+// (per RFC: registry hostnames are case-insensitive); the path/owner/name are
+// matched exactly.
 func imageMatches(projectImage, incomingImage string) bool {
-	return projectImage == incomingImage
+	if projectImage == incomingImage {
+		return true
+	}
+	pIdx := strings.IndexByte(projectImage, '/')
+	iIdx := strings.IndexByte(incomingImage, '/')
+	if pIdx <= 0 || iIdx <= 0 {
+		return false
+	}
+	pHost, pPath := projectImage[:pIdx], projectImage[pIdx:]
+	iHost, iPath := incomingImage[:iIdx], incomingImage[iIdx:]
+	return strings.EqualFold(pHost, iHost) && pPath == iPath
 }
 
 // siteRefMatches reports whether a Git ref (e.g. "refs/heads/main" or