feat(workload): switch ListProxyRoutes to containers index

The Proxies page consumer (and the secondary callers in
internal/api/health.go and internal/api/settings.go) now read
from the normalized containers index instead of the instances
table. Stage ID is recovered through a (project_id, role=stage_name)
join — uniquely-indexed via the existing UNIQUE(project_id, name)
constraint on stages.

Source field stays "instance" for back-compat with the Proxies
page filter (the frontend keys off the literal string).

Three new tests pin the join shape, verify the npm_proxy_id-only
WHERE branch survives, and check that an orphan-role row falls
out of the join cleanly (catches a regression to LEFT JOIN).

internal/store/instances.go

@@ -139,17 +139,24 @@ type ProxyRoute struct {
 	CreatedAt    string `json:"created_at"`
 }
 
-// ListProxyRoutes returns all instances that have a proxy configured, joined with project/stage names.
+// ListProxyRoutes returns proxy-enabled project containers joined with
+// project + stage names. Reads from the normalized containers index — the
+// instances table is no longer queried. Stage ID is resolved through a
+// (project_id, role=stage_name) join, which is uniquely indexed.
+//
+// Source is reported as "instance" for back-compat with the Proxies page
+// filter (which keys off the literal string).
 func (s *Store) ListProxyRoutes(domain string) ([]ProxyRoute, error) {
 	rows, err := s.db.Query(`
-		SELECT i.id, i.project_id, p.name, i.stage_id, s.name,
-		       i.image_tag, i.subdomain, i.container_id, i.port,
-		       i.proxy_route_id, i.npm_proxy_id, i.status, i.created_at
-		FROM instances i
-		JOIN projects p ON p.id = i.project_id
-		JOIN stages s ON s.id = i.stage_id
-		WHERE i.subdomain != '' AND (i.proxy_route_id != '' OR i.npm_proxy_id > 0)
-		ORDER BY p.name, s.name, i.created_at DESC`,
+		SELECT c.id, p.id, p.name, s.id, s.name,
+		       c.image_tag, c.subdomain, c.container_id, c.port,
+		       c.proxy_route_id, c.npm_proxy_id, c.state, c.created_at
+		FROM containers c
+		JOIN workloads w ON w.id = c.workload_id AND w.kind = 'project'
+		JOIN projects   p ON p.id = w.ref_id
+		JOIN stages     s ON s.project_id = p.id AND s.name = c.role
+		WHERE c.subdomain != '' AND (c.proxy_route_id != '' OR c.npm_proxy_id > 0)
+		ORDER BY p.name, s.name, c.created_at DESC`,
 	)
 	if err != nil {
 		return nil, fmt.Errorf("query proxy routes: %w", err)