fix(observability): address final review findings

Critical fixes:
- Fix StaleContainer frontend type to match nested backend response shape
- Guard ContainerID[:12] slice against empty/short IDs in ListAllProxies

High-priority fixes:
- Support comma-separated severity/source in event log filtering (IN clause)
- Eliminate N+1 queries in ListAllProxies and FindStaleInstances (pre-load maps)
- Stop leaking internal error messages to API clients (use slog + generic msgs)

internal/api/proxy.go

@@ -2,6 +2,7 @@ package api
 
 import (
 	"context"
+	"log/slog"
 	"net/http"
 	"time"
 
@@ -65,7 +66,8 @@ func (s *Server) createProxy(w http.ResponseWriter, r *http.Request) {
 
 	p, err := s.proxyManager.CreateProxy(r.Context(), req)
 	if err != nil {
-		respondError(w, http.StatusInternalServerError, err.Error())
+		slog.Error("failed to create proxy", "domain", req.Domain, "error", err)
+		respondError(w, http.StatusInternalServerError, "failed to create proxy")
 		return
 	}
 
@@ -82,7 +84,8 @@ func (s *Server) listProxies(w http.ResponseWriter, r *http.Request) {
 
 	proxies, err := s.proxyManager.ListProxies()
 	if err != nil {
-		respondError(w, http.StatusInternalServerError, err.Error())
+		slog.Error("proxy operation failed", "error", err)
+		respondError(w, http.StatusInternalServerError, "proxy operation failed")
 		return
 	}
 
@@ -104,7 +107,8 @@ func (s *Server) getProxy(w http.ResponseWriter, r *http.Request) {
 			respondNotFound(w, "proxy")
 			return
 		}
-		respondError(w, http.StatusInternalServerError, err.Error())
+		slog.Error("proxy operation failed", "error", err)
+		respondError(w, http.StatusInternalServerError, "proxy operation failed")
 		return
 	}
 
@@ -145,7 +149,8 @@ func (s *Server) updateProxy(w http.ResponseWriter, r *http.Request) {
 			respondNotFound(w, "proxy")
 			return
 		}
-		respondError(w, http.StatusInternalServerError, err.Error())
+		slog.Error("proxy operation failed", "error", err)
+		respondError(w, http.StatusInternalServerError, "proxy operation failed")
 		return
 	}
 
@@ -167,7 +172,8 @@ func (s *Server) deleteProxy(w http.ResponseWriter, r *http.Request) {
 			respondNotFound(w, "proxy")
 			return
 		}
-		respondError(w, http.StatusInternalServerError, err.Error())
+		slog.Error("proxy operation failed", "error", err)
+		respondError(w, http.StatusInternalServerError, "proxy operation failed")
 		return
 	}
 
@@ -184,7 +190,8 @@ func (s *Server) listAllProxies(w http.ResponseWriter, r *http.Request) {
 
 	views, err := s.proxyManager.ListAllProxies()
 	if err != nil {
-		respondError(w, http.StatusInternalServerError, err.Error())
+		slog.Error("proxy operation failed", "error", err)
+		respondError(w, http.StatusInternalServerError, "proxy operation failed")
 		return
 	}