chore(workload): close the workload-first arc — apps i18n + codemap + tests

Closes the workload-first refactor by landing the Priority 3 polish
items and the Priority 4 test gap. Net: ~2,400 lines added,
~350 lines modified across 13 files.

Priority 3 — polish
- apps.* i18n namespace: 276 new keys across apps.list.* (27),
  apps.new.* (91, sibling of existing apps.new.triggers.*), and
  apps.detail.* (158, sibling of existing apps.detail.bindings.*).
  EN+RU at 1314 keys each, perfectly in sync. /apps, /apps/new,
  /apps/[id] now render entirely from i18n.
- New codemap docs/CODEMAPS/workload-plugin.md (238 lines):
  Source × Trigger contract, dispatch seam, webhook fan-out path,
  recipes for adding a new Source or Trigger kind. Plus
  docs/CODEMAPS/INDEX.md gateway.

Priority 4 — tests
- internal/api/workloads_test.go (new, ~30 subtests): /api/workloads
  CRUD + deploy + delete + env + volumes + chain + promote-from +
  triggers list/inline-bind + auth gating + standalone /api/triggers
  CRUD (create / dup-409 / kind filter / delete). Uses real
  POST handlers via httptest.NewServer + a fake plugin source
  registered under "testfakesource".
- internal/deployer/dispatch_test.go (new, 11 tests):
  DispatchPlugin / DispatchTeardown / DispatchReconcile happy +
  unknown-kind + propagated-error each; PluginDeps wiring; a real
  2s-bounded RWMutex deadlock probe on PluginDeps vs SetDNSProvider.
- internal/workload/plugin/source/compose/compose_test.go (new,
  ~26 subtests): composeProjectName sanitization,
  writeYAML / writeYAMLIfChanged hash short-circuit, Validate happy
  + bad inputs, Kind / SchemaSample.

Coverage delta on the workload-plugin path:
- internal/api: 1.1% → 16.0%
- internal/deployer: 0% → 54.1%
- internal/workload/plugin/source/compose: 0% → 38.5%
- Trigger plugins already at 87-95% from the trigger-split work.

Production fix surfaced by the tests
- store.CreateWorkload now self-references RefID = ID when caller
  leaves RefID empty (the typical plugin-native path). The api
  layer's broken backfill loop (called UpdateWorkload, which
  deliberately omits ref_id) is gone. Multiple sibling plugin
  workloads can now coexist under the UNIQUE(kind, ref_id) constraint.

Review fixes addressed before commit
- CRITICAL: deadlock-detect test gained a real 2s time.After (was
  selecting on context.Background().Done() which never fires).
- HIGH: happy-path test now hard-asserts RefID = ID (was a t.Logf
  that would silently pass after a production fix).
- HIGH: standalone /api/triggers CRUD coverage added (was bypassed
  by the workload-side bind flow).
- HIGH: seedWorkload bypass deleted; tests now go through the
  real POST /api/workloads handler.
- MEDIUM: withTempDir restore is a no-op (t.Setenv auto-restores);
  dead `old := os.Getenv(...)` capture removed.
- MEDIUM: list-workloads test now asserts ID membership, not just
  count.

Doc
- WORKLOAD_REFACTOR_TODO: all three Priority 1 items, Priority 3
  polish, and Priority 4 tests marked DONE. The workload-first arc
  is closed.

docs/WORKLOAD_REFACTOR_TODO.md

@@ -9,26 +9,26 @@ order.
 
 > ## Current focus (read this first)
 >
-> **Hard legacy cutover — DONE** (2026-05-16). All three Priority 1 items
-> are now shipped. The legacy `/api/{projects,stages,stacks,sites,
-> deploys,instances}/*` HTTP surface, every backing table (`projects`,
-> `stages`, `stage_env`, `volumes`, `deploys`, `deploy_logs`,
-> `poll_states`, `stacks`, `stack_revisions`, `stack_deploys`,
-> `static_sites`, `static_site_secrets`), the project-deploy pipeline
-> (`bluegreen.go`, `promote.go`, `rollback.go`, `subdomain.go` + most of
-> `deployer.go`), the legacy webhook routes (`/api/webhook/{secret}`,
-> `/api/webhook/sites/{secret}`, `/api/webhook/workloads/{secret}`), and
-> the legacy frontend (`/projects`, `/stacks`, `/sites`, `/deploy`) are
-> gone. The `internal/staticsite/{provider,gitea_content,
-> github_provider,gitlab_provider,markdown,deno}` and
-> `internal/stack/{compose,parse,validate}` files survive only as
-> helpers imported by the static + compose plugins.
+> **Workload-first arc is complete (2026-05-16).** Priority 1 (trigger
+> split, static inline port, hard cutover), Priority 3 polish (`apps.*`
+> i18n namespace — 276 keys EN+RU; codemap for
+> `internal/workload/plugin/`), and Priority 4 tests (`/api/workloads/*`
+> integration tests, dispatcher coverage, compose helper coverage) all
+> shipped. The legacy `/api/{projects,stages,stacks,sites,deploys,
+> instances}/*` HTTP surface, every backing table, the project-deploy
+> pipeline, the legacy webhook routes, and the legacy frontend
+> (`/projects`, `/stacks`, `/sites`, `/deploy`) are gone.
 >
-> **Next focus** is **Priority 3 polish** — the `apps.*` i18n namespace
-> still has ~60 hardcoded English strings on `/apps` and `/apps/new`,
-> and `docs/CODEMAPS/` lacks an entry for `internal/workload/plugin/`.
-> After that, **Priority 4 tests** — `/api/workloads/*` integration tests
-> and dispatcher coverage.
+> Coverage delta on the workload-plugin path: `internal/api`
+> 1.1% → 16.0%, `internal/deployer` 0% → 54.1%,
+> `internal/workload/plugin/source/compose` 0% → 38.5%. Trigger plugins
+> already had ≥87% coverage from the trigger-split work.
+>
+> **What's next** is open — the remaining items in the doc are nice-to-
+> haves (richer kind-aware UI forms for new trigger kinds; a /triggers
+> deep-link from the proxies page; more compose-source coverage that
+> needs a `compose` exec seam). Pick from the task list or close the
+> arc.
 
 ## Status at a glance
 
@@ -42,9 +42,9 @@ order.
 | Vendor-specific webhook parsing | 2 | DONE |
 | Chain-panel CSS | 3 | DONE |
 | Log Rules panel on `/apps/[id]` | adjacent | DONE — uses `getEffectiveLogScanRules` + per-workload override action |
-| i18n for `/apps/*` page strings | 3 | **PARTIAL** — Log Rules panel + Observability surfaces i18n'd; `apps.*` namespace still pending |
-| Docs / codemap entries for `internal/workload/plugin/` | 3 | **PENDING** |
-| API-handler / dispatcher / compose-source / static-backend tests | 4 | **PENDING** |
+| Docs / codemap entries for `internal/workload/plugin/` | 3 | **DONE** (2026-05-16) |
+| API-handler / dispatcher / compose-source tests | 4 | **DONE** (2026-05-16) |
+| i18n for `/apps/*` page strings | 3 | **DONE** (2026-05-16) — 276 keys added under `apps.list.*` / `apps.new.*` / `apps.detail.*` |
 
 Cross-references to the adjacent Observability work (Event Triggers + Log
 Scanner backend + drop-counter stats panel) live in