feat(docker-watcher): phase 12 - hardening

Blue-green zero-downtime deploys, promote flow validation.
Dual auth: local (bcrypt + JWT) and OAuth2/OIDC (any provider).
Auth middleware, login page, auth settings UI.
Structured logging (slog JSON), config export to YAML.
Graceful shutdown with deploy draining.
Multi-stage Dockerfile and production docker-compose.yml.
Swap phase order: Volumes & Env before UI Polish.

internal/api/config_export.go

@@ -0,0 +1,21 @@
+package api
+
+import (
+	"net/http"
+
+	"github.com/alexei/docker-watcher/internal/config"
+)
+
+// exportConfig handles GET /api/config/export — downloads current state as YAML.
+func (s *Server) exportConfig(w http.ResponseWriter, r *http.Request) {
+	data, err := config.ExportConfig(s.store)
+	if err != nil {
+		respondError(w, http.StatusInternalServerError, "failed to export config: "+err.Error())
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/x-yaml")
+	w.Header().Set("Content-Disposition", "attachment; filename=docker-watcher.yaml")
+	w.WriteHeader(http.StatusOK)
+	w.Write(data)
+}