refactor(workload): finalize containers index + post-review hardening

Wraps up the workload refactor with the fixes that came out of the multi-agent
code review (see docs/plans/workload-refactor.md "What actually shipped").

Backend:
- store.ReconcileContainer: separate write path so the 30s reconciler tick no
  longer overwrites deployer-owned fields (subdomain, proxy_route_id,
  npm_proxy_id, image_tag).
- Container.stage_id column + index; ListProxyRoutes / ListContainersByStageID
  join via stage_id (survives stage rename), with legacy fallback to
  (project_id, role=stage_name).
- Reconciler: workload-existence check (rejects forged tinyforge.workload.id
  labels), skips inventing project-kind rows, child-context cancel before
  wg.Wait() on shutdown.
- Transactional CRUD across projects / stacks / static_sites: parent UPDATE
  and workload sync land in one transaction so secret rotations are durable.
- Webhook routing reads exclusively through workloads.webhook_secret; legacy
  GetProjectByWebhookSecret / GetStaticSiteByWebhookSecret fallback removed.
- store.GetStackByComposeProjectName + indexed lookup (no more full-table
  stack scan per compose container per tick).
- store.ListMissingSweepRows: filtered query for the missing-sweep.
- /api/instances/* handlers verify (workload_id, role) match URL
  (project_id, stage_name) before mutating — closes the cross-project
  hijack the security review flagged.
- extra_json no longer referenced from Go (column kept on disk for now).

Frontend:
- WorkloadContainers.svelte: generic detail-page panel reusable by stack and
  site detail pages.
- Containers page polish: client-side kind/state filters over an unfiltered
  fetch, URL-synced filters, race-safe loads via sequence number, EN+RU i18n,
  sidebar counter via navCounts.containers.

Misc:
- scripts/dev-server.sh: tolerate empty netstat grep result.
- .gitignore: ignore docker-watcher binaries, .claude/worktrees/, .facts-sync.json.

web/src/lib/api.ts

@@ -167,6 +167,13 @@ function del<T>(path: string): Promise<T> {
 	return request<T>(path, { method: 'DELETE' });
 }
 
+function patch<T>(path: string, body: unknown): Promise<T> {
+	return request<T>(path, {
+		method: 'PATCH',
+		body: JSON.stringify(body)
+	});
+}
+
 // ── Projects ────────────────────────────────────────────────────────
 
 export function listProjects(signal?: AbortSignal): Promise<Project[]> {
@@ -1068,10 +1075,7 @@ export function listWorkloadContainers(id: string, signal?: AbortSignal): Promis
 }
 
 export function setWorkloadAppID(id: string, appID: string): Promise<Workload> {
-	return request<Workload>(`/api/workloads/${id}/app`, {
-		method: 'PATCH',
-		body: JSON.stringify({ app_id: appID })
-	});
+	return patch<Workload>(`/api/workloads/${id}/app`, { app_id: appID });
 }
 
 // ── Containers (global index) ───────────────────────────────────────
@@ -1086,7 +1090,9 @@ export interface ListContainersFilter {
 export function listContainers(filter: ListContainersFilter = {}, signal?: AbortSignal): Promise<ContainerView[]> {
 	const params = new URLSearchParams();
 	for (const [k, v] of Object.entries(filter)) {
-		if (v) params.set(k, String(v));
+		// Skip unset / empty filters; explicitly check undefined and '' instead
+		// of truthy so future filter shapes (numbers, booleans) aren't dropped.
+		if (v !== undefined && v !== '') params.set(k, String(v));
 	}
 	const qs = params.toString();
 	const path = qs ? `/api/containers?${qs}` : '/api/containers';