refactor(workload): extract Instance entirely; Container is canonical

End-to-end extraction of the Instance concept. After this commit:

  * internal/store/instances.go — DELETED
  * internal/store/models.go — Instance struct gone, ProxyRoute moved here
  * containers table is the single source of truth for project/stack/site
    container state. instances table is dropped via DROP TABLE migration
    (idempotent; re-runnable on every boot).
  * Legacy tinyforge.project / tinyforge.stage / tinyforge.instance-id
    Docker labels are no longer emitted; only tinyforge.workload.{id,kind},
    tinyforge.role, and tinyforge.managed are stamped on new containers.

Backend rewrites:
  - internal/deployer:        executeDeploy + blueGreenDeploy + rollback +
                              promote use store.Container natively. New
                              removeContainer() replaces removeInstance().
                              enforceMaxInstances reads via
                              ListContainersByStageID.
  - internal/reconciler:      legacy tinyforge.instance-id dispatch removed;
                              upsertByWorkloadLabel now finds existing rows
                              by docker container ID first and falls back to
                              the deterministic workloadID:role key.
  - internal/stale/scanner:   Scan + new FindStaleContainers walk the
                              containers table; emit StaleContainer JSON.
  - internal/stats/collector: ListContainers replaces ListAllInstances.
  - internal/webhook/handler: workload-secret lookup tried first; falls back
                              to project / static_site secret column.
  - internal/api: instances.go, stale.go, stats.go, stats_history.go,
                  projects.go, settings.go, docker.go, dns.go all read /
                  write through Container.

Docker layer:
  - ManagedContainer exposes WorkloadID/Kind/Role from the canonical labels.
  - ListContainers filters by tinyforge.managed=true.
  - Network creation uses LabelManaged instead of LabelProject.

Frontend:
  - Instance type is now a Container alias; .status → .state,
    .last_alive_at → .last_seen_at.
  - InstanceCard takes stageId as a prop (no longer derived from Instance).
  - StaleContainer JSON shape rewritten: { container, workload_name, role,
    days_stale }. StaleContainerCard + /containers/stale page updated.
  - ProjectCard / homepage / SystemHealthCard filter by .state.

The migration loop now tolerates "no such table" alongside "duplicate
column" / "already exists" so obsolete ALTER TABLE entries targeting the
dropped instances table no-op cleanly on first boot.

Tests: store + deployer + reconciler + webhook + staticsite + notify all
still pass. Frontend svelte-check: zero errors.

internal/api/docker.go

@@ -69,39 +69,46 @@ func (s *Server) listProjectImages(w http.ResponseWriter, r *http.Request) {
 }
 
 // streamContainerLogs handles GET /api/projects/{id}/stages/{stage}/instances/{iid}/logs.
-// Streams container logs via SSE. Supports query params:
-// - tail: number of lines from end (default "200")
-// - follow: "true" to stream new lines in real-time
+// Streams container logs via SSE. {iid} is the container row ID. Ownership is
+// verified by joining through workload + stage so an attacker cannot stream
+// logs for a foreign container by guessing IDs under the wrong project URL.
 func (s *Server) streamContainerLogs(w http.ResponseWriter, r *http.Request) {
 	projectID := chi.URLParam(r, "id")
 	stageID := chi.URLParam(r, "stage")
-	instanceID := chi.URLParam(r, "iid")
+	containerRowID := chi.URLParam(r, "iid")
 
-	inst, err := s.store.GetInstanceByID(instanceID)
+	c, err := s.store.GetContainerByID(containerRowID)
 	if err != nil {
 		if errors.Is(err, store.ErrNotFound) {
-			respondNotFound(w, "instance")
+			respondNotFound(w, "container")
 			return
 		}
-		slog.Error("failed to get instance", "error", err)
+		slog.Error("failed to get container", "error", err)
 		respondError(w, http.StatusInternalServerError, "internal server error")
 		return
 	}
 
-	// Verify the instance actually belongs to the project/stage in the path.
-	// Without this, a user could stream logs for any instance ID by guessing
-	// it under the wrong project — defence-in-depth for future per-project ACLs.
-	if inst.ProjectID != projectID || inst.StageID != stageID {
-		respondNotFound(w, "instance")
+	wl, err := s.store.GetWorkloadByID(c.WorkloadID)
+	if err != nil {
+		respondNotFound(w, "container")
+		return
+	}
+	stage, err := s.store.GetStageByID(stageID)
+	if err != nil || stage.ProjectID != projectID {
+		respondNotFound(w, "container")
+		return
+	}
+	if wl.Kind != string(store.WorkloadKindProject) || wl.RefID != projectID || c.Role != stage.Name {
+		respondNotFound(w, "container")
 		return
 	}
 
-	if inst.ContainerID == "" {
-		respondError(w, http.StatusBadRequest, "instance has no container")
+	if c.ContainerID == "" {
+		respondError(w, http.StatusBadRequest, "container row has no docker container bound")
 		return
 	}
 
-	s.streamLogsForContainer(w, r, inst.ContainerID)
+	s.streamLogsForContainer(w, r, c.ContainerID)
 }
 
 // streamLogsForContainer streams logs for an arbitrary container ID using the