fix(observability): address final review findings

Critical fixes:
- Fix StaleContainer frontend type to match nested backend response shape
- Guard ContainerID[:12] slice against empty/short IDs in ListAllProxies

High-priority fixes:
- Support comma-separated severity/source in event log filtering (IN clause)
- Eliminate N+1 queries in ListAllProxies and FindStaleInstances (pre-load maps)
- Stop leaking internal error messages to API clients (use slog + generic msgs)

internal/proxy/manager.go

@@ -233,22 +233,39 @@ func (m *Manager) ListAllProxies() ([]ProxyView, error) {
 		return nil, fmt.Errorf("list instances: %w", err)
 	}
 
+	// Pre-load project and stage names to avoid N+1 queries.
+	allProjects, _ := m.store.GetAllProjects()
+	projectNames := make(map[string]string, len(allProjects))
+	for _, p := range allProjects {
+		projectNames[p.ID] = p.Name
+	}
+	stageNames := make(map[string]string)
+	for _, p := range allProjects {
+		stages, _ := m.store.GetStagesByProjectID(p.ID)
+		for _, s := range stages {
+			stageNames[s.ID] = s.Name
+		}
+	}
+
 	for _, inst := range instances {
 		if inst.NpmProxyID <= 0 {
 			continue
 		}
 
-		projectName := inst.ProjectID
-		stageName := inst.StageID
-
-		if proj, err := m.store.GetProjectByID(inst.ProjectID); err == nil {
-			projectName = proj.Name
+		projectName := projectNames[inst.ProjectID]
+		if projectName == "" {
+			projectName = inst.ProjectID
 		}
-		if stg, err := m.store.GetStageByID(inst.StageID); err == nil {
-			stageName = stg.Name
+		stageName := stageNames[inst.StageID]
+		if stageName == "" {
+			stageName = inst.StageID
 		}
 
-		destination := fmt.Sprintf("%s:%d", inst.ContainerID[:12], inst.Port)
+		cid := inst.ContainerID
+		if len(cid) > 12 {
+			cid = cid[:12]
+		}
+		destination := fmt.Sprintf("%s:%d", cid, inst.Port)
 		if inst.Subdomain != "" {
 			destination = fmt.Sprintf("%s:%d", inst.Subdomain, inst.Port)
 		}