refactor(plugin): centralize workload conversion + container cleanup

Three packages (api, reconciler, webhook) each carried a private 30-line
toPluginWorkload() copy that had drifted — only the api version logged
malformed public_faces JSON; the others swallowed it. Hoist the single
implementation to plugin.WorkloadFromStore() (convert.go); store is
already a plugin dependency so no new import edge or cycle forms.

Likewise the dockerfile and static sources each had a private
removeContainerByName() that disagreed (remove-all vs stop-at-first).
Docker enforces unique container names, so the two were equivalent for
every reachable state; converge on plugin.RemoveContainerByName()
(container.go, stop-at-first) with a note on why remove-all was moot.

Callers migrated; old copies removed. Adds convert_test.go pinning the
field-by-field contract and JSON edge cases.

internal/api/workload_convert.go

@@ -2,48 +2,17 @@ package api
 
 import (
 	"encoding/json"
-	"log/slog"
 
 	"github.com/alexei/tinyforge/internal/store"
 	"github.com/alexei/tinyforge/internal/workload/plugin"
 )
 
-// toPluginWorkload converts a persisted store.Workload row into the value
-// shape that Source / Trigger plugins consume. Lives in the api package
-// (rather than store or plugin) to keep plugin's dependency graph free of
-// store imports and avoid the cycle that would form otherwise.
-//
-// SourceConfig / TriggerConfig are passed through as raw JSON; the matching
-// plugin decodes them with plugin.SourceConfigOf[T] / TriggerConfigOf[T].
-// PublicFaces is decoded eagerly because every consumer needs the parsed
-// slice (proxy registration, UI, validation).
+// toPluginWorkload is a local alias for the shared plugin.WorkloadFromStore
+// converter, kept so the api package's many call sites read tersely and pair
+// visually with fromPluginWorkload below. The conversion logic lives in the
+// plugin package (the single home shared with reconciler / webhook).
 func toPluginWorkload(w store.Workload) plugin.Workload {
-	var faces []plugin.PublicFace
-	if w.PublicFaces != "" {
-		if err := json.Unmarshal([]byte(w.PublicFaces), &faces); err != nil {
-			slog.Warn("workload: invalid public_faces JSON, treating as empty",
-				"workload", w.ID, "error", err)
-			faces = nil
-		}
-	}
-	return plugin.Workload{
-		ID:                      w.ID,
-		Name:                    w.Name,
-		GroupID:                 w.AppID,
-		ParentWorkloadID:        w.ParentWorkloadID,
-		SourceKind:              w.SourceKind,
-		SourceConfig:            json.RawMessage(w.SourceConfig),
-		TriggerKind:             w.TriggerKind,
-		TriggerConfig:           json.RawMessage(w.TriggerConfig),
-		PublicFaces:             faces,
-		NotificationURL:         w.NotificationURL,
-		NotificationSecret:      w.NotificationSecret,
-		WebhookSecret:           w.WebhookSecret,
-		WebhookSigningSecret:    w.WebhookSigningSecret,
-		WebhookRequireSignature: w.WebhookRequireSignature,
-		CreatedAt:               w.CreatedAt,
-		UpdatedAt:               w.UpdatedAt,
-	}
+	return plugin.WorkloadFromStore(w)
 }
 
 // fromPluginWorkload is the symmetric direction — used by /api/workloads