refactor(workload): finalize containers index + post-review hardening

Wraps up the workload refactor with the fixes that came out of the multi-agent
code review (see docs/plans/workload-refactor.md "What actually shipped").

Backend:
- store.ReconcileContainer: separate write path so the 30s reconciler tick no
  longer overwrites deployer-owned fields (subdomain, proxy_route_id,
  npm_proxy_id, image_tag).
- Container.stage_id column + index; ListProxyRoutes / ListContainersByStageID
  join via stage_id (survives stage rename), with legacy fallback to
  (project_id, role=stage_name).
- Reconciler: workload-existence check (rejects forged tinyforge.workload.id
  labels), skips inventing project-kind rows, child-context cancel before
  wg.Wait() on shutdown.
- Transactional CRUD across projects / stacks / static_sites: parent UPDATE
  and workload sync land in one transaction so secret rotations are durable.
- Webhook routing reads exclusively through workloads.webhook_secret; legacy
  GetProjectByWebhookSecret / GetStaticSiteByWebhookSecret fallback removed.
- store.GetStackByComposeProjectName + indexed lookup (no more full-table
  stack scan per compose container per tick).
- store.ListMissingSweepRows: filtered query for the missing-sweep.
- /api/instances/* handlers verify (workload_id, role) match URL
  (project_id, stage_name) before mutating — closes the cross-project
  hijack the security review flagged.
- extra_json no longer referenced from Go (column kept on disk for now).

Frontend:
- WorkloadContainers.svelte: generic detail-page panel reusable by stack and
  site detail pages.
- Containers page polish: client-side kind/state filters over an unfiltered
  fetch, URL-synced filters, race-safe loads via sequence number, EN+RU i18n,
  sidebar counter via navCounts.containers.

Misc:
- scripts/dev-server.sh: tolerate empty netstat grep result.
- .gitignore: ignore docker-watcher binaries, .claude/worktrees/, .facts-sync.json.

web/src/lib/i18n/ru.json

@@ -732,6 +732,8 @@
     "loading": "Загрузка...",
     "noData": "Нет данных",
     "project": "Проект",
+    "stack": "Стек",
+    "site": "Сайт",
     "back": "Назад",
     "actions": "Действия",
     "stop": "Остановить",
@@ -743,7 +745,31 @@
     "next": "Далее",
     "yes": "Да",
     "no": "Нет",
-    "saving": "Сохранение..."
+    "saving": "Сохранение...",
+    "refresh": "Обновить",
+    "all": "Все",
+    "running": "Работает",
+    "stopped": "Остановлен",
+    "missing": "Отсутствует"
+  },
+  "containers": {
+    "errLoad": "Не удалось загрузить контейнеры",
+    "searchPlaceholder": "Поиск по нагрузке, роли, образу, поддомену…",
+    "kindFilterLabel": "Тип нагрузки",
+    "stateFilterLabel": "Состояние контейнера",
+    "emptyTitle": "Нет контейнеров",
+    "emptyDesc": "Разверните проект, стек или сайт — контейнеры появятся здесь.",
+    "noMatch": "Нет контейнеров, подходящих под фильтры.",
+    "showingN": "Показано {visible} из {total} контейнеров",
+    "col": {
+      "workload": "Нагрузка",
+      "kind": "Тип",
+      "role": "Роль",
+      "image": "Образ",
+      "state": "Состояние",
+      "subdomain": "Поддомен",
+      "lastSeen": "Замечен"
+    }
   },
   "instance": {
     "stopConfirm": "Контейнер будет остановлен. Экземпляр можно будет запустить снова позже.",