fix(observability): address final review findings

Critical fixes:
- Fix StaleContainer frontend type to match nested backend response shape
- Guard ContainerID[:12] slice against empty/short IDs in ListAllProxies

High-priority fixes:
- Support comma-separated severity/source in event log filtering (IN clause)
- Eliminate N+1 queries in ListAllProxies and FindStaleInstances (pre-load maps)
- Stop leaking internal error messages to API clients (use slog + generic msgs)

internal/store/eventlog.go

@@ -54,12 +54,32 @@ func (s *Store) ListEvents(filter EventLogFilter) ([]EventLog, error) {
 	var args []any
 
 	if filter.Severity != "" {
-		conditions = append(conditions, "severity = ?")
-		args = append(args, filter.Severity)
+		parts := strings.Split(filter.Severity, ",")
+		if len(parts) == 1 {
+			conditions = append(conditions, "severity = ?")
+			args = append(args, filter.Severity)
+		} else {
+			placeholders := make([]string, len(parts))
+			for i, p := range parts {
+				placeholders[i] = "?"
+				args = append(args, strings.TrimSpace(p))
+			}
+			conditions = append(conditions, "severity IN ("+strings.Join(placeholders, ",")+")")
+		}
 	}
 	if filter.Source != "" {
-		conditions = append(conditions, "source = ?")
-		args = append(args, filter.Source)
+		parts := strings.Split(filter.Source, ",")
+		if len(parts) == 1 {
+			conditions = append(conditions, "source = ?")
+			args = append(args, filter.Source)
+		} else {
+			placeholders := make([]string, len(parts))
+			for i, p := range parts {
+				placeholders[i] = "?"
+				args = append(args, strings.TrimSpace(p))
+			}
+			conditions = append(conditions, "source IN ("+strings.Join(placeholders, ",")+")")
+		}
 	}
 	if filter.Since != "" {
 		conditions = append(conditions, "created_at >= ?")