feat(docker-watcher): phase 9 - SvelteKit dashboard & project views

SvelteKit project with Svelte 5, TypeScript, Tailwind CSS v4.
Dashboard with project cards, project detail with stage/instance
management, deploy history, instance controls. Shared API client
and reusable components (StatusBadge, InstanceCard, ProjectCard,
ConfirmDialog). Add Phase 14 (Volumes & Environment) to plan.

PLAN.md

@@ -287,14 +287,52 @@ Full dashboard for visibility, manual control, and configuration.
 22. **Embed in Go** — build SvelteKit to static, embed with `go:embed`, serve from Go
 23. **Real-time updates** — SSE for deploy progress and instance status changes
 
-### Phase 4: Hardening
+### Phase 4: Volumes & Environment
 
-24. **Blue-green deploys** — start new, health check, swap, stop old (zero downtime)
-25. **Promote flow** — enforce `promote_from` for production deploys
-26. **Auth on dashboard** — basic auth or token-based
-27. **Graceful shutdown** — drain in-progress deploys on SIGTERM
-28. **Structured logging** — JSON logs with deploy context
-29. **Config export** — download current SQLite state as YAML
+Persistent storage and app-specific configuration for deployed containers.
+
+24. **Environment variables per project** — key/value pairs stored in SQLite, sensitive values encrypted
+25. **Per-stage env overrides** — e.g., `NODE_ENV=development` for dev, `NODE_ENV=production` for prod
+26. **Volume mounts per project** — configurable source/target paths with shared/isolated modes
+27. **Shared volumes** — all instances of a project mount the same host path (for stateless apps or shared uploads)
+28. **Isolated volumes** — each instance gets its own subdirectory: `{source}/{stage}-{tag}/` → `{target}` (for stateful apps with local DBs/files)
+29. **UI for volumes & env** — project settings page with key/value editor, volume list, shared/isolated toggle, per-stage override support
+
+Volume config per project:
+```yaml
+env:
+  NODE_ENV: production
+  DATABASE_URL: postgres://db:5432/myapp    # shared external DB
+  SECRET_KEY: "..."                          # encrypted in SQLite
+volumes:
+  - source: /data/my-app/uploads
+    target: /app/uploads
+    mode: shared        # all instances share this path
+  - source: /data/my-app/data
+    target: /app/data
+    mode: isolated      # auto-appends /{stage}-{tag}/ to source
+```
+
+Stage-level env overrides:
+```yaml
+stages:
+  dev:
+    env:
+      NODE_ENV: development       # overrides project-level
+      DATABASE_URL: postgres://db:5432/myapp_dev
+  prod:
+    env:
+      NODE_ENV: production        # uses project-level default
+```
+
+### Phase 5: Hardening
+
+30. **Blue-green deploys** — start new, health check, swap, stop old (zero downtime)
+31. **Promote flow** — enforce `promote_from` for production deploys
+32. **Auth on dashboard** — basic auth or token-based
+33. **Graceful shutdown** — drain in-progress deploys on SIGTERM
+34. **Structured logging** — JSON logs with deploy context
+35. **Config export** — download current SQLite state as YAML
 
 ## Key Dependencies (Go)