feat(workload): write-through workload sync + boot-time backfill

CRUD on Project / Stack / StaticSite now keeps a paired Workload
row in sync. Secret setters (webhook secret, signing secret,
require-signature toggle, notification secret) all re-sync after
mutating the source-of-truth row so the workload row always
reflects the canonical state.

Delete cascades: DeleteProject/Stack/StaticSite now drop the
matching workload row plus any container index entries owned by
it, so global views don't show ghost rows.

Boot-time BackfillWorkloads scans every project/stack/site and
ensures each has a workload row. Idempotent — safe to run on
every restart, recovers from a deleted/missing workload row.

Behavior unchanged for existing call sites; the workloads table
just starts being populated. Deployer / reconciler / consumer
switchover land in the next commit.

cmd/server/main.go

@@ -73,6 +73,13 @@ func main() {
 		os.Exit(1)
 	}
 
+	// Backfill workload rows for any project / stack / static site that
+	// predates the workload refactor. Idempotent — safe on every boot.
+	if err := db.BackfillWorkloads(); err != nil {
+		slog.Error("workload backfill", "error", err)
+		os.Exit(1)
+	}
+
 	// Ensure default admin user exists on first launch.
 	if err := ensureDefaultAdmin(db); err != nil {
 		slog.Error("ensure default admin", "error", err)