refactor(workload): extract Instance entirely; Container is canonical

End-to-end extraction of the Instance concept. After this commit:

  * internal/store/instances.go — DELETED
  * internal/store/models.go — Instance struct gone, ProxyRoute moved here
  * containers table is the single source of truth for project/stack/site
    container state. instances table is dropped via DROP TABLE migration
    (idempotent; re-runnable on every boot).
  * Legacy tinyforge.project / tinyforge.stage / tinyforge.instance-id
    Docker labels are no longer emitted; only tinyforge.workload.{id,kind},
    tinyforge.role, and tinyforge.managed are stamped on new containers.

Backend rewrites:
  - internal/deployer:        executeDeploy + blueGreenDeploy + rollback +
                              promote use store.Container natively. New
                              removeContainer() replaces removeInstance().
                              enforceMaxInstances reads via
                              ListContainersByStageID.
  - internal/reconciler:      legacy tinyforge.instance-id dispatch removed;
                              upsertByWorkloadLabel now finds existing rows
                              by docker container ID first and falls back to
                              the deterministic workloadID:role key.
  - internal/stale/scanner:   Scan + new FindStaleContainers walk the
                              containers table; emit StaleContainer JSON.
  - internal/stats/collector: ListContainers replaces ListAllInstances.
  - internal/webhook/handler: workload-secret lookup tried first; falls back
                              to project / static_site secret column.
  - internal/api: instances.go, stale.go, stats.go, stats_history.go,
                  projects.go, settings.go, docker.go, dns.go all read /
                  write through Container.

Docker layer:
  - ManagedContainer exposes WorkloadID/Kind/Role from the canonical labels.
  - ListContainers filters by tinyforge.managed=true.
  - Network creation uses LabelManaged instead of LabelProject.

Frontend:
  - Instance type is now a Container alias; .status → .state,
    .last_alive_at → .last_seen_at.
  - InstanceCard takes stageId as a prop (no longer derived from Instance).
  - StaleContainer JSON shape rewritten: { container, workload_name, role,
    days_stale }. StaleContainerCard + /containers/stale page updated.
  - ProjectCard / homepage / SystemHealthCard filter by .state.

The migration loop now tolerates "no such table" alongside "duplicate
column" / "already exists" so obsolete ALTER TABLE entries targeting the
dropped instances table no-op cleanly on first boot.

Tests: store + deployer + reconciler + webhook + staticsite + notify all
still pass. Frontend svelte-check: zero errors.

web/src/routes/+page.svelte

@@ -86,12 +86,12 @@
 	const totalRunning = $derived(
 		Object.values(instancesByProject)
 			.flat()
-			.filter((i) => i.status === 'running').length
+			.filter((i) => i.state === 'running').length
 	);
 	const totalFailed = $derived(
 		Object.values(instancesByProject)
 			.flat()
-			.filter((i) => i.status === 'failed').length
+			.filter((i) => i.state === 'failed').length
 	);
 	const totalStale = $derived(staleContainers.length);
 	const totalSites = $derived(sites.length);

web/src/routes/containers/stale/+page.svelte

@@ -41,7 +41,7 @@
 		cleaningIds = new Set([...cleaningIds, id]);
 		try {
 			await api.cleanupStaleContainer(id);
-			containers = containers.filter((c) => c.instance.id !== id);
+			containers = containers.filter((c) => c.container.id !== id);
 			toasts.success($t('stale.cleanedUp'));
 		} catch (e) {
 			toasts.error(e instanceof Error ? e.message : $t('stale.cleanupFailed'));
@@ -124,10 +124,10 @@
 		/>
 	{:else}
 		<div class="grid grid-cols-1 gap-4 sm:grid-cols-2 lg:grid-cols-3">
-			{#each containers as container (container.instance.id)}
+			{#each containers as container (container.container.id)}
 				<StaleContainerCard
 					{container}
-					cleaning={cleaningIds.has(container.instance.id)}
+					cleaning={cleaningIds.has(container.container.id)}
 					oncleanup={requestCleanup}
 				/>
 			{/each}

web/src/routes/projects/[id]/+page.svelte

@@ -757,6 +757,7 @@
 											<InstanceCard
 												{instance}
 												{projectId}
+												stageId={stage.id}
 												domain={settingsDomain}
 												onchange={loadProject}
 											/>