fix(observability): address final review findings

Critical fixes:
- Fix StaleContainer frontend type to match nested backend response shape
- Guard ContainerID[:12] slice against empty/short IDs in ListAllProxies

High-priority fixes:
- Support comma-separated severity/source in event log filtering (IN clause)
- Eliminate N+1 queries in ListAllProxies and FindStaleInstances (pre-load maps)
- Stop leaking internal error messages to API clients (use slog + generic msgs)

internal/api/stale.go

@@ -22,7 +22,8 @@ func (s *Server) listStaleContainers(w http.ResponseWriter, r *http.Request) {
 
 	staleInstances, err := s.staleScanner.FindStaleInstances(r.Context())
 	if err != nil {
-		respondError(w, http.StatusInternalServerError, "failed to find stale containers: "+err.Error())
+		slog.Error("failed to find stale containers", "error", err)
+		respondError(w, http.StatusInternalServerError, "failed to find stale containers")
 		return
 	}
 
@@ -43,7 +44,8 @@ func (s *Server) cleanupStaleContainer(w http.ResponseWriter, r *http.Request) {
 			respondNotFound(w, "instance")
 			return
 		}
-		respondError(w, http.StatusInternalServerError, "failed to get instance: "+err.Error())
+		slog.Error("failed to get instance", "instance_id", instanceID, "error", err)
+		respondError(w, http.StatusInternalServerError, "failed to get instance")
 		return
 	}
 
@@ -54,7 +56,8 @@ func (s *Server) cleanupStaleContainer(w http.ResponseWriter, r *http.Request) {
 	}
 
 	if err := s.cleanupInstance(r, inst); err != nil {
-		respondError(w, http.StatusInternalServerError, "failed to cleanup instance: "+err.Error())
+		slog.Error("failed to cleanup instance", "instance_id", instanceID, "error", err)
+		respondError(w, http.StatusInternalServerError, "failed to cleanup instance")
 		return
 	}
 
@@ -71,7 +74,8 @@ func (s *Server) bulkCleanupStaleContainers(w http.ResponseWriter, r *http.Reque
 
 	staleInstances, err := s.staleScanner.FindStaleInstances(r.Context())
 	if err != nil {
-		respondError(w, http.StatusInternalServerError, "failed to find stale containers: "+err.Error())
+		slog.Error("failed to find stale containers for bulk cleanup", "error", err)
+		respondError(w, http.StatusInternalServerError, "failed to find stale containers")
 		return
 	}