fix: comprehensive security, performance, and quality hardening

Security: apply AdminOnly middleware to mutating routes, require
ENCRYPTION_KEY and ADMIN_PASSWORD (no insecure defaults), restrict
CORS to same-origin, fix OIDC token delivery via cookie instead of
URL query param, add rate limiting on login, add MaxBytesReader,
validate volume paths against traversal, add security headers,
validate user roles, add Secure flag to OIDC cookie.

Performance: set SQLite MaxOpenConns(1) to prevent SQLITE_BUSY,
add FK indexes on 8 columns, track notifier goroutines with
WaitGroup for graceful shutdown, use GetRegistryByName instead of
GetAllRegistries in deployer, pass basePath param to avoid redundant
settings query, return empty slices from store to remove reflection.

Quality: refactor TriggerDeploy to delegate to runDeploy (~100 lines
removed), consolidate duplicated utilities (extractPort, boolToInt,
now, isTerminalStatus) into shared exports, migrate all log.Printf
to slog structured logging, use consistent webhook response envelope,
remove dead code (parseEnvVars, duplicate auth types).

UX: clean up NPM proxy on instance removal via API, add README with
quickstart guide, add .env.example, require ADMIN_PASSWORD in
docker-compose, document staging-net prerequisite.

internal/store/store.go

@@ -24,6 +24,10 @@ func New(dbPath string) (*Store, error) {
 		return nil, fmt.Errorf("open database: %w", err)
 	}
 
+	// SQLite only allows one writer at a time. Limit connections to prevent SQLITE_BUSY.
+	db.SetMaxOpenConns(1)
+	db.SetConnMaxLifetime(0)
+
 	// Enable WAL mode and foreign keys for better concurrency and referential integrity.
 	pragmas := []string{
 		"PRAGMA journal_mode=WAL",
@@ -79,6 +83,24 @@ func (s *Store) runMigrations() error {
 		// Ignore errors from already-applied migrations (duplicate column).
 		_, _ = s.db.Exec(m)
 	}
+
+	// Create indexes on foreign key columns for query performance.
+	indexes := []string{
+		`CREATE INDEX IF NOT EXISTS idx_instances_stage_id ON instances(stage_id)`,
+		`CREATE INDEX IF NOT EXISTS idx_instances_project_id ON instances(project_id)`,
+		`CREATE INDEX IF NOT EXISTS idx_deploys_project_id ON deploys(project_id)`,
+		`CREATE INDEX IF NOT EXISTS idx_deploys_stage_id ON deploys(stage_id)`,
+		`CREATE INDEX IF NOT EXISTS idx_deploy_logs_deploy_id ON deploy_logs(deploy_id)`,
+		`CREATE INDEX IF NOT EXISTS idx_stages_project_id ON stages(project_id)`,
+		`CREATE INDEX IF NOT EXISTS idx_stage_env_stage_id ON stage_env(stage_id)`,
+		`CREATE INDEX IF NOT EXISTS idx_volumes_project_id ON volumes(project_id)`,
+	}
+	for _, idx := range indexes {
+		if _, err := s.db.Exec(idx); err != nil {
+			return fmt.Errorf("create index: %w", err)
+		}
+	}
+
 	return nil
 }
 
@@ -224,7 +246,7 @@ CREATE TABLE IF NOT EXISTS volumes (
 );
 `
 
-// now returns the current time formatted for SQLite storage.
-func now() string {
+// Now returns the current time formatted for SQLite storage.
+func Now() string {
 	return time.Now().UTC().Format("2006-01-02 15:04:05")
 }