fix(observability): address final review findings

Critical fixes:
- Fix StaleContainer frontend type to match nested backend response shape
- Guard ContainerID[:12] slice against empty/short IDs in ListAllProxies

High-priority fixes:
- Support comma-separated severity/source in event log filtering (IN clause)
- Eliminate N+1 queries in ListAllProxies and FindStaleInstances (pre-load maps)
- Stop leaking internal error messages to API clients (use slog + generic msgs)

internal/api/proxy.go

@@ -2,6 +2,7 @@ package api
 
 import (
 	"context"
+	"log/slog"
 	"net/http"
 	"time"
 
@@ -65,7 +66,8 @@ func (s *Server) createProxy(w http.ResponseWriter, r *http.Request) {
 
 	p, err := s.proxyManager.CreateProxy(r.Context(), req)
 	if err != nil {
-		respondError(w, http.StatusInternalServerError, err.Error())
+		slog.Error("failed to create proxy", "domain", req.Domain, "error", err)
+		respondError(w, http.StatusInternalServerError, "failed to create proxy")
 		return
 	}
 
@@ -82,7 +84,8 @@ func (s *Server) listProxies(w http.ResponseWriter, r *http.Request) {
 
 	proxies, err := s.proxyManager.ListProxies()
 	if err != nil {
-		respondError(w, http.StatusInternalServerError, err.Error())
+		slog.Error("proxy operation failed", "error", err)
+		respondError(w, http.StatusInternalServerError, "proxy operation failed")
 		return
 	}
 
@@ -104,7 +107,8 @@ func (s *Server) getProxy(w http.ResponseWriter, r *http.Request) {
 			respondNotFound(w, "proxy")
 			return
 		}
-		respondError(w, http.StatusInternalServerError, err.Error())
+		slog.Error("proxy operation failed", "error", err)
+		respondError(w, http.StatusInternalServerError, "proxy operation failed")
 		return
 	}
 
@@ -145,7 +149,8 @@ func (s *Server) updateProxy(w http.ResponseWriter, r *http.Request) {
 			respondNotFound(w, "proxy")
 			return
 		}
-		respondError(w, http.StatusInternalServerError, err.Error())
+		slog.Error("proxy operation failed", "error", err)
+		respondError(w, http.StatusInternalServerError, "proxy operation failed")
 		return
 	}
 
@@ -167,7 +172,8 @@ func (s *Server) deleteProxy(w http.ResponseWriter, r *http.Request) {
 			respondNotFound(w, "proxy")
 			return
 		}
-		respondError(w, http.StatusInternalServerError, err.Error())
+		slog.Error("proxy operation failed", "error", err)
+		respondError(w, http.StatusInternalServerError, "proxy operation failed")
 		return
 	}
 
@@ -184,7 +190,8 @@ func (s *Server) listAllProxies(w http.ResponseWriter, r *http.Request) {
 
 	views, err := s.proxyManager.ListAllProxies()
 	if err != nil {
-		respondError(w, http.StatusInternalServerError, err.Error())
+		slog.Error("proxy operation failed", "error", err)
+		respondError(w, http.StatusInternalServerError, "proxy operation failed")
 		return
 	}
 

internal/api/stale.go

@@ -22,7 +22,8 @@ func (s *Server) listStaleContainers(w http.ResponseWriter, r *http.Request) {
 
 	staleInstances, err := s.staleScanner.FindStaleInstances(r.Context())
 	if err != nil {
-		respondError(w, http.StatusInternalServerError, "failed to find stale containers: "+err.Error())
+		slog.Error("failed to find stale containers", "error", err)
+		respondError(w, http.StatusInternalServerError, "failed to find stale containers")
 		return
 	}
 
@@ -43,7 +44,8 @@ func (s *Server) cleanupStaleContainer(w http.ResponseWriter, r *http.Request) {
 			respondNotFound(w, "instance")
 			return
 		}
-		respondError(w, http.StatusInternalServerError, "failed to get instance: "+err.Error())
+		slog.Error("failed to get instance", "instance_id", instanceID, "error", err)
+		respondError(w, http.StatusInternalServerError, "failed to get instance")
 		return
 	}
 
@@ -54,7 +56,8 @@ func (s *Server) cleanupStaleContainer(w http.ResponseWriter, r *http.Request) {
 	}
 
 	if err := s.cleanupInstance(r, inst); err != nil {
-		respondError(w, http.StatusInternalServerError, "failed to cleanup instance: "+err.Error())
+		slog.Error("failed to cleanup instance", "instance_id", instanceID, "error", err)
+		respondError(w, http.StatusInternalServerError, "failed to cleanup instance")
 		return
 	}
 
@@ -71,7 +74,8 @@ func (s *Server) bulkCleanupStaleContainers(w http.ResponseWriter, r *http.Reque
 
 	staleInstances, err := s.staleScanner.FindStaleInstances(r.Context())
 	if err != nil {
-		respondError(w, http.StatusInternalServerError, "failed to find stale containers: "+err.Error())
+		slog.Error("failed to find stale containers for bulk cleanup", "error", err)
+		respondError(w, http.StatusInternalServerError, "failed to find stale containers")
 		return
 	}
 

internal/api/stats.go

@@ -2,6 +2,7 @@ package api
 
 import (
 	"errors"
+	"log/slog"
 	"net/http"
 
 	"github.com/go-chi/chi/v5"
@@ -20,7 +21,8 @@ func (s *Server) getInstanceStats(w http.ResponseWriter, r *http.Request) {
 			respondNotFound(w, "instance")
 			return
 		}
-		respondError(w, http.StatusInternalServerError, "failed to get instance: "+err.Error())
+		slog.Error("failed to get instance", "instance_id", instanceID, "error", err)
+		respondError(w, http.StatusInternalServerError, "failed to get instance")
 		return
 	}
 
@@ -31,7 +33,8 @@ func (s *Server) getInstanceStats(w http.ResponseWriter, r *http.Request) {
 
 	stats, err := s.docker.GetContainerStats(r.Context(), inst.ContainerID)
 	if err != nil {
-		respondError(w, http.StatusInternalServerError, "failed to get container stats: "+err.Error())
+		slog.Error("failed to get container stats", "container_id", inst.ContainerID, "error", err)
+		respondError(w, http.StatusInternalServerError, "failed to get container stats")
 		return
 	}