fix(observability): address final review findings

Critical fixes:
- Fix StaleContainer frontend type to match nested backend response shape
- Guard ContainerID[:12] slice against empty/short IDs in ListAllProxies

High-priority fixes:
- Support comma-separated severity/source in event log filtering (IN clause)
- Eliminate N+1 queries in ListAllProxies and FindStaleInstances (pre-load maps)
- Stop leaking internal error messages to API clients (use slog + generic msgs)

internal/api/stats.go

@@ -2,6 +2,7 @@ package api
 
 import (
 	"errors"
+	"log/slog"
 	"net/http"
 
 	"github.com/go-chi/chi/v5"
@@ -20,7 +21,8 @@ func (s *Server) getInstanceStats(w http.ResponseWriter, r *http.Request) {
 			respondNotFound(w, "instance")
 			return
 		}
-		respondError(w, http.StatusInternalServerError, "failed to get instance: "+err.Error())
+		slog.Error("failed to get instance", "instance_id", instanceID, "error", err)
+		respondError(w, http.StatusInternalServerError, "failed to get instance")
 		return
 	}
 
@@ -31,7 +33,8 @@ func (s *Server) getInstanceStats(w http.ResponseWriter, r *http.Request) {
 
 	stats, err := s.docker.GetContainerStats(r.Context(), inst.ContainerID)
 	if err != nil {
-		respondError(w, http.StatusInternalServerError, "failed to get container stats: "+err.Error())
+		slog.Error("failed to get container stats", "container_id", inst.ContainerID, "error", err)
+		respondError(w, http.StatusInternalServerError, "failed to get container stats")
 		return
 	}