refactor(workload): extract Instance entirely; Container is canonical

End-to-end extraction of the Instance concept. After this commit:

  * internal/store/instances.go — DELETED
  * internal/store/models.go — Instance struct gone, ProxyRoute moved here
  * containers table is the single source of truth for project/stack/site
    container state. instances table is dropped via DROP TABLE migration
    (idempotent; re-runnable on every boot).
  * Legacy tinyforge.project / tinyforge.stage / tinyforge.instance-id
    Docker labels are no longer emitted; only tinyforge.workload.{id,kind},
    tinyforge.role, and tinyforge.managed are stamped on new containers.

Backend rewrites:
  - internal/deployer:        executeDeploy + blueGreenDeploy + rollback +
                              promote use store.Container natively. New
                              removeContainer() replaces removeInstance().
                              enforceMaxInstances reads via
                              ListContainersByStageID.
  - internal/reconciler:      legacy tinyforge.instance-id dispatch removed;
                              upsertByWorkloadLabel now finds existing rows
                              by docker container ID first and falls back to
                              the deterministic workloadID:role key.
  - internal/stale/scanner:   Scan + new FindStaleContainers walk the
                              containers table; emit StaleContainer JSON.
  - internal/stats/collector: ListContainers replaces ListAllInstances.
  - internal/webhook/handler: workload-secret lookup tried first; falls back
                              to project / static_site secret column.
  - internal/api: instances.go, stale.go, stats.go, stats_history.go,
                  projects.go, settings.go, docker.go, dns.go all read /
                  write through Container.

Docker layer:
  - ManagedContainer exposes WorkloadID/Kind/Role from the canonical labels.
  - ListContainers filters by tinyforge.managed=true.
  - Network creation uses LabelManaged instead of LabelProject.

Frontend:
  - Instance type is now a Container alias; .status → .state,
    .last_alive_at → .last_seen_at.
  - InstanceCard takes stageId as a prop (no longer derived from Instance).
  - StaleContainer JSON shape rewritten: { container, workload_name, role,
    days_stale }. StaleContainerCard + /containers/stale page updated.
  - ProjectCard / homepage / SystemHealthCard filter by .state.

The migration loop now tolerates "no such table" alongside "duplicate
column" / "already exists" so obsolete ALTER TABLE entries targeting the
dropped instances table no-op cleanly on first boot.

Tests: store + deployer + reconciler + webhook + staticsite + notify all
still pass. Frontend svelte-check: zero errors.

internal/api/settings.go

@@ -466,14 +466,14 @@ func (s *Server) resyncAllProxies(oldSettings, newSettings store.Settings) {
 	// Step 2: If new provider is "none", clear all proxy route IDs and we're done.
 	if newSettings.ProxyProvider == "none" {
 		for _, route := range routes {
-			inst, err := s.store.GetInstanceByID(route.InstanceID)
+			c, err := s.store.GetContainerByID(route.InstanceID)
 			if err != nil {
 				continue
 			}
-			inst.ProxyRouteID = ""
-			inst.NpmProxyID = 0
-			if err := s.store.UpdateInstance(inst); err != nil {
-				slog.Warn("proxy resync: clear route ID", "instance", route.InstanceID, "error", err)
+			c.ProxyRouteID = ""
+			c.NpmProxyID = 0
+			if err := s.store.UpdateContainer(c); err != nil {
+				slog.Warn("proxy resync: clear route ID", "container", route.InstanceID, "error", err)
 			}
 		}
 		slog.Info("proxy resync: cleared all proxy routes (provider set to none)", "count", len(routes))
@@ -501,18 +501,17 @@ func (s *Server) resyncAllProxies(oldSettings, newSettings store.Settings) {
 			continue
 		}
 
-		// Update instance with new route ID.
-		inst, err := s.store.GetInstanceByID(route.InstanceID)
+		// Update container row with new route ID.
+		c, err := s.store.GetContainerByID(route.InstanceID)
 		if err != nil {
 			continue
 		}
-		inst.ProxyRouteID = routeID
+		c.ProxyRouteID = routeID
 		if domainChanged {
-			// Subdomain stays the same, but the FQDN in external systems changed.
-			slog.Info("proxy resync: domain updated", "instance", route.InstanceID, "domain", fqdn)
+			slog.Info("proxy resync: domain updated", "container", route.InstanceID, "domain", fqdn)
 		}
-		if err := s.store.UpdateInstance(inst); err != nil {
-			slog.Warn("proxy resync: update instance", "instance", route.InstanceID, "error", err)
+		if err := s.store.UpdateContainer(c); err != nil {
+			slog.Warn("proxy resync: update container", "container", route.InstanceID, "error", err)
 		}
 		updated++
 	}