fix(observability): address final review findings

Critical fixes:
- Fix StaleContainer frontend type to match nested backend response shape
- Guard ContainerID[:12] slice against empty/short IDs in ListAllProxies

High-priority fixes:
- Support comma-separated severity/source in event log filtering (IN clause)
- Eliminate N+1 queries in ListAllProxies and FindStaleInstances (pre-load maps)
- Stop leaking internal error messages to API clients (use slog + generic msgs)

internal/stale/scanner.go

@@ -226,6 +226,20 @@ func (s *Scanner) FindStaleInstances(ctx context.Context) ([]StaleInstance, erro
 		}
 	}
 
+	// Pre-load project and stage names to avoid N+1 queries.
+	allProjects, _ := s.store.GetAllProjects()
+	projectNames := make(map[string]string, len(allProjects))
+	for _, p := range allProjects {
+		projectNames[p.ID] = p.Name
+	}
+	stageNames := make(map[string]string)
+	for _, p := range allProjects {
+		stages, _ := s.store.GetStagesByProjectID(p.ID)
+		for _, st := range stages {
+			stageNames[st.ID] = st.Name
+		}
+	}
+
 	now := time.Now().UTC()
 	var result []StaleInstance
 
@@ -254,14 +268,14 @@ func (s *Scanner) FindStaleInstances(ctx context.Context) ([]StaleInstance, erro
 			continue
 		}
 
-		// Look up project and stage names.
-		projectName := inst.ProjectID
-		stageName := inst.StageID
-		if proj, err := s.store.GetProjectByID(inst.ProjectID); err == nil {
-			projectName = proj.Name
+		// Look up project and stage names from pre-loaded maps.
+		projectName := projectNames[inst.ProjectID]
+		if projectName == "" {
+			projectName = inst.ProjectID
 		}
-		if stg, err := s.store.GetStageByID(inst.StageID); err == nil {
-			stageName = stg.Name
+		stageName := stageNames[inst.StageID]
+		if stageName == "" {
+			stageName = inst.StageID
 		}
 
 		result = append(result, StaleInstance{