feat(docker-watcher): phase 6 - webhook handler

Secret UUID-based webhook endpoint for CI image push notifications.
Project/stage matching via glob patterns, auto-creation of unknown
projects from image inspection. Fix JSON response injection.

internal/store/instances.go

@@ -26,6 +26,27 @@ func (s *Store) CreateInstance(inst Instance) (Instance, error) {
 	return inst, nil
 }
 
+// CreateInstanceWithID inserts a new instance using a pre-generated ID.
+// Use this when the ID must be known before creation (e.g., for container labels).
+func (s *Store) CreateInstanceWithID(inst Instance) (Instance, error) {
+	if inst.ID == "" {
+		return Instance{}, fmt.Errorf("instance ID is required")
+	}
+	inst.CreatedAt = now()
+	inst.UpdatedAt = inst.CreatedAt
+
+	_, err := s.db.Exec(
+		`INSERT INTO instances (id, stage_id, project_id, container_id, image_tag, subdomain, npm_proxy_id, status, port, created_at, updated_at)
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		inst.ID, inst.StageID, inst.ProjectID, inst.ContainerID, inst.ImageTag,
+		inst.Subdomain, inst.NpmProxyID, inst.Status, inst.Port, inst.CreatedAt, inst.UpdatedAt,
+	)
+	if err != nil {
+		return Instance{}, fmt.Errorf("insert instance: %w", err)
+	}
+	return inst, nil
+}
+
 // GetInstanceByID returns a single instance by its ID.
 func (s *Store) GetInstanceByID(id string) (Instance, error) {
 	var inst Instance