fix: comprehensive security, performance, and quality hardening

Security: apply AdminOnly middleware to mutating routes, require
ENCRYPTION_KEY and ADMIN_PASSWORD (no insecure defaults), restrict
CORS to same-origin, fix OIDC token delivery via cookie instead of
URL query param, add rate limiting on login, add MaxBytesReader,
validate volume paths against traversal, add security headers,
validate user roles, add Secure flag to OIDC cookie.

Performance: set SQLite MaxOpenConns(1) to prevent SQLITE_BUSY,
add FK indexes on 8 columns, track notifier goroutines with
WaitGroup for graceful shutdown, use GetRegistryByName instead of
GetAllRegistries in deployer, pass basePath param to avoid redundant
settings query, return empty slices from store to remove reflection.

Quality: refactor TriggerDeploy to delegate to runDeploy (~100 lines
removed), consolidate duplicated utilities (extractPort, boolToInt,
now, isTerminalStatus) into shared exports, migrate all log.Printf
to slog structured logging, use consistent webhook response envelope,
remove dead code (parseEnvVars, duplicate auth types).

UX: clean up NPM proxy on instance removal via API, add README with
quickstart guide, add .env.example, require ADMIN_PASSWORD in
docker-compose, document staging-net prerequisite.

internal/registry/poller.go

@@ -3,7 +3,7 @@ package registry
 import (
 	"context"
 	"fmt"
-	"log"
+	"log/slog"
 	"sync"
 	"time"
 
@@ -56,7 +56,7 @@ func (p *Poller) Start(interval string) error {
 		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
 		defer cancel()
 		if pollErr := p.poll(ctx); pollErr != nil {
-			log.Printf("[poller] poll error: %v", pollErr)
+			slog.Warn("poller: poll error", "error", pollErr)
 		}
 	})
 	if err != nil {
@@ -69,7 +69,7 @@ func (p *Poller) Start(interval string) error {
 	}
 	p.running = true
 
-	log.Printf("[poller] started with interval %s", duration)
+	slog.Info("poller started", "interval", duration.String())
 	return nil
 }
 
@@ -82,7 +82,7 @@ func (p *Poller) Stop() {
 		ctx := p.cron.Stop()
 		<-ctx.Done()
 		p.running = false
-		log.Println("[poller] stopped")
+		slog.Info("poller stopped")
 	}
 }
 
@@ -96,8 +96,7 @@ func (p *Poller) poll(ctx context.Context) error {
 
 	for _, project := range projects {
 		if err := p.pollProject(ctx, project); err != nil {
-			log.Printf("[poller] project %s (%s): %v", project.Name, project.ID, err)
-			// Continue polling other projects even if one fails.
+			slog.Warn("poller: project error", "project", project.Name, "id", project.ID, "error", err)
 		}
 	}
 	return nil
@@ -109,32 +108,26 @@ func (p *Poller) pollProject(ctx context.Context, project store.Project) error {
 		return nil
 	}
 
-	// Look up the registry configuration by name (projects store registry name, not ID).
 	reg, err := p.store.GetRegistryByName(project.Registry)
 	if err != nil {
 		return fmt.Errorf("get registry %s: %w", project.Registry, err)
 	}
 
-	// Decrypt the registry token.
 	token, err := crypto.Decrypt(p.encKey, reg.Token)
 	if err != nil {
-		// Token might not be encrypted (empty or plaintext).
 		token = reg.Token
 	}
 
-	// Create a registry client for this registry type.
 	client, err := NewClient(reg.Type, reg.URL, token)
 	if err != nil {
 		return fmt.Errorf("create registry client: %w", err)
 	}
 
-	// Fetch all available tags for the project image.
 	tags, err := client.ListTags(ctx, project.Image)
 	if err != nil {
 		return fmt.Errorf("list tags for %s: %w", project.Image, err)
 	}
 
-	// Check each stage of the project.
 	stages, err := p.store.GetStagesByProjectID(project.ID)
 	if err != nil {
 		return fmt.Errorf("get stages for project %s: %w", project.ID, err)
@@ -142,7 +135,7 @@ func (p *Poller) pollProject(ctx context.Context, project store.Project) error {
 
 	for _, stage := range stages {
 		if err := p.pollStage(ctx, project, stage, tags); err != nil {
-			log.Printf("[poller] project %s stage %s: %v", project.Name, stage.Name, err)
+			slog.Warn("poller: stage error", "project", project.Name, "stage", stage.Name, "error", err)
 		}
 	}
 	return nil
@@ -150,7 +143,6 @@ func (p *Poller) pollProject(ctx context.Context, project store.Project) error {
 
 // pollStage checks a single stage for new tags and triggers deploy if needed.
 func (p *Poller) pollStage(ctx context.Context, project store.Project, stage store.Stage, allTags []string) error {
-	// Find the latest tag matching the stage's pattern.
 	latest, err := LatestTag(allTags, stage.TagPattern)
 	if err != nil {
 		return fmt.Errorf("match tags for stage %s: %w", stage.Name, err)
@@ -159,41 +151,33 @@ func (p *Poller) pollStage(ctx context.Context, project store.Project, stage sto
 		return nil
 	}
 
-	// Get the last polled tag for this stage.
 	state, err := p.store.GetPollState(stage.ID)
 	if err != nil {
-		// No poll state yet — this is the first poll for this stage.
-		// Record the current latest tag without triggering a deploy,
-		// so we don't deploy everything on first startup.
 		return p.store.UpsertPollState(store.PollState{
 			StageID:    stage.ID,
 			LastTag:    latest,
-			LastPolled: now(),
+			LastPolled: store.Now(),
 		})
 	}
 
-	// Update the poll timestamp regardless.
 	defer func() {
 		if err := p.store.UpsertPollState(store.PollState{
 			StageID:    stage.ID,
 			LastTag:    latest,
-			LastPolled: now(),
+			LastPolled: store.Now(),
 		}); err != nil {
-			log.Printf("[poller] failed to update poll state for stage %s: %v", stage.ID, err)
+			slog.Warn("poller: failed to update poll state", "stage_id", stage.ID, "error", err)
 		}
 	}()
 
-	// If the latest tag hasn't changed, nothing to do.
 	if state.LastTag == latest {
 		return nil
 	}
 
-	log.Printf("[poller] new tag %q detected for project %s stage %s (was %q)",
-		latest, project.Name, stage.Name, state.LastTag)
+	slog.Info("poller: new tag detected", "tag", latest, "project", project.Name, "stage", stage.Name, "previous", state.LastTag)
 
-	// Only trigger deploy if auto_deploy is enabled for this stage.
 	if !stage.AutoDeploy {
-		log.Printf("[poller] auto_deploy disabled for stage %s, skipping deploy", stage.Name)
+		slog.Info("poller: auto_deploy disabled, skipping", "stage", stage.Name)
 		return nil
 	}
 
@@ -203,8 +187,3 @@ func (p *Poller) pollStage(ctx context.Context, project store.Project, stage sto
 
 	return nil
 }
-
-// now returns the current UTC time as a formatted string.
-func now() string {
-	return time.Now().UTC().Format("2006-01-02 15:04:05")
-}